Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder sql-chart-builder allows DOM-Based XSS.This issue affects SQL Chart Builder: from n/a through <= 2.3.7.2.
Published: 2025-09-22
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of input during web page generation in Guaven Labs SQL Chart Builder results in a DOM‑based XSS flaw. The plugin renders user‑supplied data without sanitizing it, allowing the injection of scripts that would execute in the victim's browser. All released versions up to and including 2.3.7.2 are affected.

Affected Systems

The vulnerability affects the Guaven Labs SQL Chart Builder plugin for WordPress. All released versions up through and including 2.3.7.2 are susceptible; any installation of the plugin before a fix is applied is at risk.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity, and the EPSS score of <1% suggests low likelihood of exploitation. The flaw is client‑side, inferred from its DOM-based nature. Exploitation requires a victim to visit a crafted page. The vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on May 1, 2026 at 06:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the SQL Chart Builder plugin to the latest available version that includes the fix.
  • If an immediate upgrade is not feasible, disable the plugin or remove any functionality that accepts external input until the issue is resolved.
  • Until a patch is available, enforce strict input validation on any chart‑generation parameters, or implement a Content Security Policy that blocks inline scripts.

Generated by OpenCVE AI on May 1, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-30593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder allows DOM-Based XSS. This issue affects SQL Chart Builder: from n/a through 2.3.7.2.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder allows DOM-Based XSS. This issue affects SQL Chart Builder: from n/a through 2.3.7.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder sql-chart-builder allows DOM-Based XSS.This issue affects SQL Chart Builder: from n/a through <= 2.3.7.2.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Tue, 23 Sep 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 23 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Mon, 22 Sep 2025 18:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder allows DOM-Based XSS. This issue affects SQL Chart Builder: from n/a through 2.3.7.2.
Title WordPress SQL Chart Builder Plugin <= 2.3.7.2 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-12T00:59:21.632Z

Reserved: 2025-08-27T16:19:35.849Z

Link: CVE-2025-58233

cve-icon Vulnrichment

Updated: 2025-09-23T15:56:37.296Z

cve-icon NVD

Status : Deferred

Published: 2025-09-22T19:16:08.493

Modified: 2026-04-23T15:33:21.123

Link: CVE-2025-58233

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T06:30:10Z

Weaknesses