Dashboard Builder – Wordpress Plugin For Charts And Graphs

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:dashboardbuilder:dashboard_builder_–_wordpress_plugin_for_charts_and_graphs:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorDashboardbuilder (1800fd44-946a-5267-8b5e-e4225617715c)
ProductDashboard Builder – Wordpress Plugin For Charts And Graphs (2f1b90b8-7aac-55d0-b294-69907e739c86)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-14615 vulnerable 2026-06-08 07:06:34.840910 DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection
HIGH (7.1)
The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This makes it possible for unauthenticated attackers to modify the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The modified SQL query is subsequently executed on the front-end when the shortcode is rendered, enabling arbitrary SQL injection and data exfiltration through the publicly visible chart output.
Published: 2026-01-14T05:28:03.897Z
Updated: 2026-04-08T16:35:58.593Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.