CVE-2026-100158
Received Received - Intake

Stored XSS in SQL Chart Builder WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-100158
EUVD
EUVD-2026-102658

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elvinhaci SQL Chart Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SQL Chart Builder plugin for WordPress has a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping in the 'X-axis column value' parameter. This allows authenticated attackers with subscriber-level access or higher to inject malicious scripts into pages. The attack requires an administrator to publish a chart with a SQL query that returns a user-controllable column, such as wp_users.display_name, which a subscriber can modify via their WordPress profile.

Detection Guidance

Check WordPress installations for the SQL Chart Builder plugin versions up to 3.0.6. Inspect WordPress user profiles for suspicious payloads in fields like display_name. Review published charts for injected scripts in SQL queries.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into WordPress pages. If exploited, it could lead to unauthorized actions on behalf of users, theft of sensitive data, or defacement of websites. Users with subscriber-level access or higher could compromise the site, and administrators may unknowingly publish infected charts.

Compliance Impact

This vulnerability could lead to data breaches, exposing user data and violating privacy regulations like GDPR or HIPAA. If exploited, it may result in unauthorized access to personal data, triggering compliance violations, legal penalties, and reputational damage for organizations handling sensitive information.

Mitigation Strategies

Update the SQL Chart Builder plugin to the latest version. Remove or disable the plugin if not needed. Audit user profiles and published charts for malicious payloads. Restrict subscriber-level access to sensitive fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart