The SKT Skill Bar plugin for WordPress contains a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into the plugin’s data fields. Once stored, the script is served to every visitor who views a page that renders the plugin data, enabling attackers to steal session cookies, deface content, or hijack user sessions, thereby compromising confidentiality and integrity of the site.

This vulnerability affects the SKT Skill Bar plugin distributed by sonalsinha21, with all releases up to and including version 2.4 deemed vulnerable; any WordPress installation using one of these versions is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The plugin is not listed in CISA's KEV catalog. The likely attack vector involves a user with content‑creation permissions injecting script payloads into the plugin’s fields, which are then rendered to all site visitors. No additional conditions beyond typical content‑submission privileges are required to exploit the flaw.