Improper neutralization of user input during web page generation allows a stored XSS flaw in the SKT Blocks plugin. Malicious code entered through the plugin’s input fields can be saved and subsequently rendered in the browser of any user that views the affected content, providing attackers opportunities for session hijacking, defacement, or delivery of further malware. The weakness is a classic input validation flaw (CWE‑79).

WordPress sites using the SKT Blocks plugin by sonalsinha21. All installed versions up to and including 1.7 are vulnerable; any higher version retains the fix.

The vulnerability has a CVSS v3.1 score of 6.5, indicating a medium‑severity risk. The EPSS score is less than 1%, suggesting that exploitation is currently rare, and it is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s administrative input interface, where attacker‑controlled data can be stored. Successful exploitation would affect all site visitors who load the affected pages. The risk is mitigated only by applying a fix or disabling the plugin.