SQL Chart Builder EUVD-2026-102658

Exploitation requires three conditions to align: (1) the attacker holds at least subscriber-level authenticated access (PR:L), typically via open registration; (2) an administrator must have published a chart whose SQL query (via $wpdb->get_results()) returns a column the lower-privileged user can populate, such as wp_users.display_name editable at /wp-admin/profile.php; and (3) a victim must subsequently view the injected chart page. The dependency on a specific admin-created chart configuration that exposes a user-controllable column is the primary limiting factor - on sites without such a chart, the vulnerability is not reachable. There is no required user interaction for payload injection itself, but payload execution depends on a victim rendering the affected page.

This is a moderate-risk, not a top-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) reflects a network-reachable, low-complexity, authenticated stored XSS with a scope change, which is consistent with the description. No EPSS score, KEV listing, or public POC is provided, so exploitation status is 'no public exploit identified at time of analysis' and there is no signal of widespread or automated exploitation. The practical risk is tempered by a meaningful precondition the raw CVSS score obscures: exploitation only works if an administrator has published a chart whose SQL query returns a column a low-privileged user can control (e.g. wp_users.display_name). This is a non-default, operator-dependent setup, so the real-world exploitable population is narrower than AV:N/AC:L alone suggests - closer to a targeted/conditional issue than a mass-exploitable flaw. The PR:L qualifier is supported by the vector and the description (subscriber-level access), so the authenticated characterization is confirmed from CVSS data. No signals conflict, but note that the attack-complexity rating arguably understates the configuration dependency.

A site allows open subscriber registration and an administrator has published a SQL Chart Builder chart whose query surfaces a user-controllable field such as display_name. An attacker registers a subscriber account, sets a malicious script as their profile display name via /wp-admin/profile.php, and waits; when an administrator or visitor views the chart page, the stored payload executes in their browser. No public exploit code is identified at time of analysis.