elvinhaci SQL Chart Builder vulnerabilities

Latest elvinhaci SQL Chart Builder CVEs

Newest publication first

1. CVE-2026-100158 SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field

   Published 2026-10-16

   Medium·CVSS 6.4 EPSS 0.19%

   The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This...

2. CVE-2024-11430 SQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injection

   Published 2024-12-12

   Medium·CVSS 6.5 EPSS 0.54%

   The SQL Chart Builder plugin for WordPress is vulnerable to SQL Injection via the 'arg1' arg of the 'gvn_schart_2' shortcode in all versions up to, and including, 2.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.