CVE-2026-100158: SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field

Q: Who can exploit this issue?

An authenticated WordPress user with Subscriber-level access or higher can inject a payload. Exploitation also depends on an administrator having published a chart whose SQL query reads a user-controllable column, such as wp_users.display_name.

Q: Are sites affected by default?

The vulnerable plugin versions are affected, but exploitation requires a specific chart configuration: a published chart must return an X-axis column that a lower-privileged user can control. A chart querying wp_users.display_name is one example.

Q: What user-controlled field can be used to deliver a payload?

A Subscriber can populate their WordPress display name through the standard profile page at /wp-admin/profile.php. If a published chart uses that value as its X-axis column, the stored script can execute when someone accesses the injected page.

Q: How can administrators identify likely exposure?

Review published SQL Chart Builder charts for SQL queries that return lower-privileged user-controlled data as the X-axis column, especially wp_users.display_name. Also review Subscriber and other low-privilege user profile display names for unexpected script content.

Published Oct 16, 2026

Updated

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xargs from $wpdb->getresults())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wpusers.displayname, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.

Affected Software

1 affected component

SQL Chart Builder<=3.0.6

Event History

Oct 16, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with Subscriber-level access or higher can inject a payload. Exploitation also depends on an administrator having published a chart whose SQL query reads a user-controllable column, such as wp_users.display_name.

Are sites affected by default?

The vulnerable plugin versions are affected, but exploitation requires a specific chart configuration: a published chart must return an X-axis column that a lower-privileged user can control. A chart querying wp_users.display_name is one example.

What user-controlled field can be used to deliver a payload?

A Subscriber can populate their WordPress display name through the standard profile page at /wp-admin/profile.php. If a published chart uses that value as its X-axis column, the stored script can execute when someone accesses the injected page.

How can administrators identify likely exposure?

Review published SQL Chart Builder charts for SQL queries that return lower-privileged user-controlled data as the X-axis column, especially wp_users.display_name. Also review Subscriber and other low-privilege user profile display names for unexpected script content.

CVE-2026-100158: SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are sites affected by default?

What user-controlled field can be used to deliver a payload?

How can administrators identify likely exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are sites affected by default?

What user-controlled field can be used to deliver a payload?

How can administrators identify likely exposure?