The SKT Blocks – Gutenberg based Page Builder plugin allows authenticated users with Contributor or higher privileges to store malicious scripts in the Post Carousel block. When a page containing such a block is viewed, the injected scripts run in the browser context of any visitor, enabling data theft, session hijacking, or defacement of the site. The flaw is caused by insufficient input sanitization and lack of output escaping, as identified by CWE‑79.

Affected are installations of the SKT Blocks – Gutenberg based Page Builder WordPress plugin from vendor sonalsinha21, in all versions up to and including 1.9. WordPress sites running any of these plugin versions are vulnerable.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires authenticated access at the Contributor level or higher, an attacker must first obtain such credentials or abuse legitimate roles. Once achieved, the stored XSS can impact all users who view the compromised page.