CVE-2026-100158: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in elvinhaci SQL Chart Builder

CVE-2026-100158 describes a stored Cross-Site Scripting vulnerability in the SQL Chart Builder WordPress plugin (versions up to 3.0.6). The vulnerability occurs because the plugin does not properly sanitize or escape the X-axis column value parameter derived from SQL query results. An authenticated attacker with subscriber-level privileges can inject arbitrary JavaScript payloads into user-controllable database fields (e.g., wp_users.display_name). When an administrator publishes a chart that includes such a column, the injected script executes in the context of any user viewing the chart page.

Successful exploitation allows an authenticated low-privilege user to inject persistent malicious scripts that execute in the browsers of users who view the affected chart pages. This can lead to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid publishing charts that include columns controllable by low-privileged users, such as wp_users.display_name, to mitigate risk.