The SKT Blocks plugin for WordPress includes a DOM‑based cross‑site scripting flaw caused by inadequate sanitization of user input. When a user visits a crafted URL or interacts with a page that contains malicious JavaScript, the script executes in the victim’s browser. This can lead to the theft of session cookies, credential compromise, or the execution of additional malicious payloads through the user’s session.

All installations of the SKT Blocks plugin that are version 2.2 or earlier are affected. WordPress sites that have mounted any version of the plugin released by sonalsinha21 up to and including 2.2 are susceptible to this vulnerability.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity risk. The EPSS score of less than 1% suggests that the likelihood of exploitation is low, and it is not listed in the CISA KEV catalog. Exploitation typically requires the attacker to supply a malicious payload through a URL or form that the plugin processes, so it is an injection type flaw (CWE‑79) that requires victim interaction and active use of the vulnerable plugin version.