The vulnerability lies in the handling of the X-axis label column in SQL Chart Builder, where user-supplied data is placed into the chart configuration without proper sanitization. An attacker with subscriber-level access can modify their profile display name, a field that the plugin later includes in charts. When a chart containing this label is rendered, the malicious script is executed in the browser of any user who views the chart page, leading to potential session hijacking, credential theft, or other web-based attacks. This is a classic example of stored cross‑site scripting (CWE‑79).

WordPress sites that have installed SQL Chart Builder versions 3.0.6 or earlier, including all releases up to and including 3.0.6. The plugin, as identified by the vendor/product name "elvinhaci:SQL Chart Builder", is the only affected component. No additional product or version details are supplied beyond the maximum impacted version of 3.0.6.

The CVSS score of 6.4 classifies the issue as moderate severity; no EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only authenticate with subscriber or higher privileges to inject a payload, and the flaw requires that an administrator publish a chart whose SQL query returns the attacker‑controlled column (e.g., wp_users.display_name). Once the chart is published, the malicious script runs for every viewer of that chart, giving the attacker widespread impact across all site users. Because the vector relies on authenticated access that is commonly available on public WordPress installations, the likelihood of exploitation is non‑negligible in environments with permissive membership levels.