# CVE-2026-100158: SQL Chart Builder stored cross-site scripting in chart rendering

Source: https://junglewise.ai/threats/cve-2026-100158-the-sql-chart-builder-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-100158 · Severity: medium · CVSS 6.4 · Published 2026-10-16

The SQL Chart Builder plugin for WordPress is vulnerable to stored cross-site scripting (XSS) in chart display. An authenticated attacker with subscriber-level access can inject malicious scripts into database columns that get rendered in charts, which then execute for any administrator or user viewing the compromised chart. This could lead to account takeover or malware distribution to WordPress users.

Vendors: [Automattic](https://junglewise.ai/threats/vendors/automattic).

## Quick answers

**Is CVE-2026-100158 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100158 being exploited in the wild.

**How severe is CVE-2026-100158?** Medium severity, with a CVSS score of 6.4, published 16 October 2026.

**Which products and versions are affected?** Automattic SQL Chart Builder up to and including 3.0.6.

**Is there a fix for CVE-2026-100158?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100158 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100158?** Check whether you run Automattic SQL Chart Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to sanitize and escape user-controlled data retrieved from database query results when rendering chart axes. An authenticated subscriber can populate WordPress user profile fields (such as display_name) with XSS payloads; if an administrator creates a chart whose SQL query returns such columns, the payload executes in the context of any user viewing the chart. The vulnerability affects all versions up to and including 3.0.6.

## Affected products

- Automattic SQL Chart Builder up to and including 3.0.6

## Timeline

- 2026-10-16: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php](https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php)
- [https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php](https://plugins.trac.wordpress.org/browser/sql-chart-builder/tags/3.0.6/functions.php)