The vulnerability resides in the SKT Blocks Gutenberg‑based page builder plugin and allows an attacker to store malicious script code within the site’s content, which is later rendered unescaped to visitors. Once executed, a stored XSS can steal cookies, session data, modify page content, or redirect users to malicious sites. The weakness is a classic Improper Neutralization of Input During Web Page Generation, classified as CWE‑79, and it can affect the confidentiality, integrity, and availability of the web application.

Any WordPress installation that has the SKT Blocks plugin version 2.0 or earlier installed is vulnerable. The plugin is distributed by sonalsinha21 under the SKT Themes brand and can be found in the WordPress plugin repository and the SKT Blocks cpe namespace.

The CVSS score of 6.5 indicates a moderate risk level. The EPSS score of less than 1% suggests that exploitation is currently considered unlikely, and the vulnerability is not listed as a known exploited target in the CISA KEV catalog. Based on the description, the attack is likely carried out by an authenticated user who can inject input into cached or persistent fields associated with the plugin, or, alternatively, a visitor who can trick the site into executing previously injected content.