CVE-2025-26771: SKT Blocks Stored XSS Vulnerability

CVE-2025-26771 Overview

CVE-2025-26771 is a stored Cross-Site Scripting (XSS) vulnerability in the SKT Blocks WordPress plugin developed by sonalsinha21. The flaw affects all plugin versions up to and including 1.7. Authenticated attackers with contributor-level privileges or higher can inject malicious scripts that persist in the WordPress database. The injected payloads execute in the browsers of users who view the affected pages. The vulnerability is tracked under CWE-79 and requires user interaction to trigger.

Critical Impact
Attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action abuse, and phishing against site visitors.

Affected Products

SKT Blocks WordPress plugin versions up to and including 1.7
WordPress sites running the skt-blocks plugin from sktthemes
Any site exposing the plugin's block editor to contributor or author roles

Discovery Timeline

2025-02-17 - CVE-2025-26771 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26771

Vulnerability Analysis

The SKT Blocks plugin provides Gutenberg block elements for WordPress. The plugin fails to properly neutralize user-supplied input before rendering it within generated web pages. Block attributes submitted through the editor are stored in post content and later rendered without adequate sanitization or output encoding.

An authenticated user with permission to edit posts can embed JavaScript payloads inside block attributes. When an administrator, editor, or site visitor loads the affected post, the browser executes the attacker's script in the context of the WordPress origin.

Stored XSS in a WordPress plugin creates a persistent attack surface. Payloads survive page reloads and reach every visitor until an administrator removes the malicious content.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under CWE-79. The plugin accepts block attribute values from editor requests without applying wp_kses filtering or equivalent output escaping functions such as esc_attr, esc_html, or esc_url before rendering stored values on the front end.

Attack Vector

Exploitation requires network access, low privileges, and user interaction. The scope is changed, meaning the vulnerable component affects resources beyond its security boundary. An attacker with contributor access authors a post containing a malicious SKT block. When a privileged user previews or publishes the content, the payload executes with that user's session context.

See the Patchstack XSS Vulnerability Report for additional advisory detail.

Detection Methods for CVE-2025-26771

Indicators of Compromise

WordPress wp_posts entries containing SKT Blocks markup with <script> tags, javascript: URIs, or inline event handlers such as onerror= and onload=
Outbound browser requests from admin sessions to unfamiliar domains referenced inside post content
New or modified administrator accounts created shortly after a contributor-authored post is viewed

Detection Strategies

Query the WordPress database for post content containing SKT block delimiters alongside HTML event handlers or script tags
Review audit logs for post edits by contributor or author accounts followed by privileged-user activity on the same post
Scan rendered pages for unexpected script sources using automated DOM inspection tooling

Monitoring Recommendations

Enable WordPress activity logging to capture post creation, revision, and publish events with user attribution
Deploy a web application firewall rule set that flags HTML payloads submitted to the block editor REST endpoints
Monitor Content Security Policy (CSP) violation reports for inline script executions on authenticated admin pages

How to Mitigate CVE-2025-26771

Immediate Actions Required

Update the SKT Blocks plugin to a version released after 1.7 once the vendor publishes a fix
Audit existing posts and reusable blocks for malicious content injected prior to patching
Restrict contributor and author role assignments to trusted users until remediation is confirmed

Patch Information

At the time of publication, no fixed version is referenced in the NVD record. Site operators should monitor the Patchstack advisory and the plugin's WordPress.org listing for updated releases beyond version 1.7.

Workarounds

Deactivate and remove the SKT Blocks plugin until a patched release is available
Enforce a strict Content Security Policy that blocks inline scripts on administrative and public-facing pages
Limit block editor access to administrator and editor roles by adjusting role capabilities with a plugin such as a role manager

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate skt-blocks
wp plugin delete skt-blocks