CVE-2026-4079

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-407906.5Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.CVE-2026-407917.1Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.CVE-2026-407926.3Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.CVE-2026-407936.5Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.CVE-2026-407946.5Subscriber Broken Access Control in myCred <= 3.0.3 versions.CVE-2026-407956.5Subscriber Broken Access Control in Amelia <= 2.2 versions.CVE-2026-407966.5Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.CVE-2026-407979.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder LLC WebinarIgnition allowsCVE-2026-407989.3Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.CVE-2026-407995.3Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.CVE-2026-40806.4The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_to_cart' shortcode in all versions up to and inCVE-2026-408009.3Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
CVE-2026-4079: Medium severity, CVSS 6.5 | Vulnix