A stored Cross‑Site Scripting flaw exists in the SKT Blocks WordPress plugin. The flaw allows an attacker to insert malicious script code that is later rendered when authenticated or unauthenticated users view any page where the plugin stores content. If executed, this can lead to session hijacking, defacement or the theft of sensitive data from the visitor’s browser. The weakness aligns with CWE‑79, indicating that user input is not properly neutralized before rendering.

WordPress sites running the SKT Blocks plugin version 2.6 or earlier are impacted. The vulnerability applies to all releases from the first available build up through 2.6. Users who do not control the plugin’s source code cannot modify input handling and must rely on official fixes from the plugin author.

The CVSS score of 6.5 reflects a moderate level of severity, yet the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Because it is a stored XSS, an attacker could exploit it by submitting specially crafted input through any interface that the plugin accepts, and the malicious content would subsequently be displayed to all visitors accessing the affected content. The attack vector is inferred to be user‑supplied data that the plugin stores and later displays without sanitization.