Requests to the Sky Addons plugin allow an authenticated user with Author or higher role to store arbitrary JavaScript code in the custom post type `sky-custom-scripts`. The code is later rendered without escaping, so any visitor loading a page that displays the script will execute the attacker’s payload. This vulnerability gives an attacker the ability to deface the frontend, steal user session cookies, or load malicious resources, compromising confidentiality and integrity for visitors.

The Sky Addons – Elementor Addons with Widgets & Templates plugin from wowdevs, all versions up to and including 3.3.2 are affected. Versions 3.3.3 and newer are not vulnerable.

The CVSS base score is 6.4, indicating a medium to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the REST API, inferred from the requirement that the attacker must be authenticated and that the vulnerability is exploited via the custom post type’s REST endpoint. Exploitation requires the attacker to have Author or higher role, which is a common role on many sites, increasing the practical risk.