The SKT Skill Bar plugin contains a stored cross‑site scripting flaw caused by improper neutralization of input during web page generation. This weakness permits an attacker to inject malicious script that will run in the context of any authenticated or unauthenticated visitor of the impacted WordPress site, enabling data theft, session hijacking, or defacement. The vulnerability is classified as CWE‑79.

Any WordPress site that has installed the sonalsinha21 SKT Skill Bar plugin with a version of 2.3 or earlier is affected. The plugin is listed under the vendor "sonalsinha21:SKT Skill Bar". No specific sub‑versions are enumerated beyond the <=2.3 cap.

The CVSS base score of 6.5 indicates a medium severity, while the EPSS score of less than 1% shows a very low current exploitation probability. This vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a stored XSS via plugin input fields; an attacker must first inject the payload, which then persists and is served to any user visiting the affected page.