Medium severity6.5NVD Advisory· Published Apr 7, 2026· Updated Apr 9, 2026

CVE-2026-4079

Description

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Guaven/SQL Chart Builder
cpe:2.3:a:guaven:sql_chart_builder:*:*:*:*:*:wordpress:*:*
Range: <2.3.8
SQL Chart Builder/SQL Chart Builder WordPress pluginllm-create
Range: < 2.3.8
WordPress/SQL Chart Builderwp-canonicalize
Package: https://wordpress.org/plugins/sql-chart-builder

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2bcc590/nvdThird Party AdvisoryExploit

News mentions

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 6, 2026 to April 12, 2026)
Wordfence Blog · Apr 16, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000