CVE-2025-3276: SKT Blocks WordPress Plugin XSS Vulnerability

CVE-2025-3276 Overview

CVE-2025-3276 is a Stored Cross-Site Scripting (XSS) vulnerability in the SKT Blocks – Gutenberg based Page Builder plugin for WordPress. The flaw affects all versions up to and including 1.9 and resides in the Post Carousel block. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who views the affected page. The issue is tracked under CWE-79 and documented in the Wordfence Vulnerability Analysis.

Critical Impact
Authenticated contributors can persist malicious JavaScript into published content, enabling session hijacking, credential theft, or administrative action forgery when privileged users visit the injected page.

Affected Products

SKT Themes SKT Blocks – Gutenberg based Page Builder plugin for WordPress
All versions from the initial release up to and including version 1.9
WordPress sites allowing Contributor-level or higher user registration

Discovery Timeline

2025-04-12 - CVE-2025-3276 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3276

Vulnerability Analysis

The vulnerability resides in the Post Carousel block shipped with SKT Blocks. The block accepts user-controlled block attributes during post or page editing and renders them into the page markup without sufficient sanitization or escaping. A contributor-level account, which can create but not publish content, can inject script payloads through configurable fields of the Post Carousel block. When an editor or administrator reviews the submitted content, or when a visitor loads the published page, the browser executes the attacker-controlled script in the site's origin.

Stored XSS in a WordPress block is particularly impactful because the payload persists in post content stored in the database. Each request that renders the affected post triggers the payload against the viewer's session. Successful execution against an administrator can lead to account takeover, plugin or theme installation, and persistent backdoor placement.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Post Carousel block's render path does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post() to attributes supplied through the editor. Insufficient server-side validation of block attributes allows raw HTML and JavaScript to be stored and later emitted into the DOM.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with Contributor privileges or higher. The attacker edits a post, inserts a Post Carousel block, and places a crafted payload into a vulnerable attribute. The malicious script executes when a user, including unauthenticated visitors or administrators, loads the rendered page. User interaction in the form of page navigation is required for the payload to fire.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-3276

Indicators of Compromise

Unexpected <script>, <svg onload=>, or event-handler attributes stored in wp_posts.post_content within Post Carousel block markup.
Outbound requests from site visitors to attacker-controlled domains sourced from pages containing the SKT Blocks Post Carousel block.
New administrator accounts, modified user roles, or unauthorized plugin installations following contributor activity.
Browser console errors or Content Security Policy violations originating from pages rendering SKT Blocks content.

Detection Strategies

Query the WordPress database for Post Carousel block comments containing script tags or JavaScript event handlers: SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wp:skt-blocks/post-carousel%' AND post_content REGEXP '(<script|onerror=|onload=|javascript:)';
Review audit logs for posts created or edited by Contributor accounts that include SKT Blocks components.
Deploy a web application firewall rule to inspect block editor REST API requests to /wp-json/wp/v2/posts for script payloads.

Monitoring Recommendations

Enable WordPress activity logging to capture post revisions by low-privilege roles.
Monitor the installed version of SKT Blocks across managed WordPress sites and alert on versions <= 1.9.
Alert on first-time outbound DNS or HTTP connections initiated from the public site to unfamiliar domains referenced in post content.

How to Mitigate CVE-2025-3276

Immediate Actions Required

Update the SKT Blocks plugin to the patched release that supersedes version 1.9 as published in the WordPress plugin changeset.
Audit all existing posts and pages containing the Post Carousel block for injected scripts and remove malicious content.
Review Contributor, Author, and Editor accounts for signs of unauthorized access and reset credentials where warranted.
Rotate any administrative session cookies and API keys that may have been exposed to injected JavaScript.

Patch Information

The vendor released a corrective changeset through the WordPress plugin repository. Site administrators should install the version released after 1.9. Patch details are available at the WordPress Changeset Update and the Wordfence advisory.

Workarounds

Deactivate the SKT Blocks plugin until the patched version is applied if immediate upgrade is not feasible.
Restrict Contributor-level and above access to trusted users only, and disable open user registration.
Deploy a Content Security Policy that restricts inline scripts and limits script sources to trusted origins.
Place a web application firewall in front of the WordPress admin and REST API endpoints to filter script payloads in block attributes.

bash

# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate skt-blocks
wp plugin status skt-blocks

# Audit post content for suspicious payloads in Post Carousel blocks
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%wp:skt-blocks/post-carousel%' \
  AND post_content REGEXP '(<script|onerror=|onload=|javascript:)';"