CVE-2026-100158
MediumCVSS 6.4Summary
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-axis column value parameter in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts that execute when a user visits an injected page. It requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page.
Risk Assessment
A low-privileged attacker (subscriber) can inject malicious JavaScript into a published chart that executes for every visitor. This can lead to session data theft or other attacks in the victim's browser context.
Recommendation
Update the SQL Chart Builder plugin to a version newer than 3.0.6 when available, and review existing charts for queries that return data controllable by low-privileged users.
Related vulnerabilities
- CVE-2026-111472Critical
An SQL injection vulnerability has been discovered in TSG Profleet. An attacker could retrieve, create, update and delete data from the database by sending a GET request using the 'Identificación' parameter of the '/cgi-bin/index.php' endpoint.
- CVE-2026-94388Critical
The Green Popups plugin (halfdata-green-popups) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The vulnerability allows an attacker to perform Blind SQL Injection.
- CVE-2026-94169Critical
The Grid plugin (the-grid) contains a Code Injection vulnerability due to improper control of code generation. The vulnerability allows an attacker to perform Command Injection.
- CVE-2026-104730Critical
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object, but with no known POP chain in the vulnerable software, it has no impact unless another plugin or theme with a POP chain is installed.
- CVE-2026-89079Critical
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password, allowing unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
- CVE-2026-103768Critical
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments, allowing unauthenticated attackers to upload files that may be executable, making remote code execution possible.
- CVE-2026-109515Critical
The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().
- CVE-2026-109219Critical
The Mang Board plugin for WordPress (versions up to and including 2.4.4) is vulnerable to arbitrary file upload via the mbw_file_upload function. Missing file extension validation on the image_path parameter allows unauthenticated attackers to upload executable files, enabling remote code execution.
- CVE-2026-104798Critical
The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.
- CVE-2026-111444Critical
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. This includes opt-in parameterize=false queries, IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments, and LIKE ESCAPE literals.
Original NVD description (English source)
The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have published a chart whose SQL query returns a column controllable by a lower-privileged user, such as wp_users.display_name, which a Subscriber can populate with a payload via the standard WordPress profile page at /wp-admin/profile.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS