CVE-2025-46235 Overview
CVE-2025-46235 is a stored cross-site scripting (XSS) vulnerability in the SKT Blocks WordPress plugin developed by sonalsinha21. The flaw affects all versions of SKT Blocks up to and including version 2.0. Attackers with contributor-level privileges or higher can inject malicious JavaScript payloads that persist in the database and execute in the browsers of users who view the affected content. The vulnerability maps to [CWE-79], Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can inject stored JavaScript into WordPress pages, enabling session theft, administrative action hijacking, and redirection of site visitors.
Affected Products
- SKT Blocks (skt-blocks) WordPress plugin by sktthemes
- All versions from n/a through <= 2.0
- WordPress sites using the Gutenberg-based page builder provided by SKT Blocks
Discovery Timeline
- 2025-04-22 - CVE CVE-2025-46235 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46235
Vulnerability Analysis
The SKT Blocks plugin extends the WordPress Gutenberg editor with custom blocks. The plugin fails to properly neutralize user-supplied input before rendering it inside page markup. An authenticated attacker with at least contributor privileges can insert JavaScript into block attributes that the plugin outputs without sufficient sanitization or escaping.
Because the payload is stored in the WordPress database, it executes every time an affected post or page is rendered. The scope change in the attack chain indicates the injected script executes in a security context different from the vulnerable component, which is typical of stored XSS that crosses origin or trust boundaries within a site.
Exploitation requires user interaction, meaning a victim must view a post or admin screen that renders the malicious block output. Successful exploitation enables theft of authentication cookies, forced actions in the context of an administrator, and content defacement.
Root Cause
The root cause is missing output escaping in the plugin's block rendering logic. User-controlled attributes passed through the Gutenberg block API are concatenated into HTML without passing through WordPress sanitization helpers such as wp_kses_post() or esc_attr().
Attack Vector
The attack vector is network-based and requires authentication at the contributor level or above. An attacker crafts a post or custom block containing a malicious script payload embedded in a vulnerable attribute. When an editor, administrator, or site visitor loads the post, the browser parses and executes the injected script in the context of the WordPress site. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-46235
Indicators of Compromise
- Post or page content containing <script> tags, javascript: URIs, or inline event handlers such as onerror and onload within SKT Blocks block attributes.
- Unexpected outbound requests from visitor or administrator browsers to attacker-controlled domains after loading pages that render SKT Blocks content.
- Creation of new administrator accounts or changes to WordPress options shortly after a contributor-authored post is published or previewed.
Detection Strategies
- Audit the wp_posts table for stored content containing script tags or encoded JavaScript inside SKT Blocks shortcodes or block markup.
- Review web server access logs for POST requests to /wp-json/wp/v2/posts or /wp-admin/post.php originating from low-privilege accounts that include suspicious payload patterns.
- Monitor for anomalous session activity following page views, including token theft indicators and cross-origin requests to unknown endpoints.
Monitoring Recommendations
- Enable WordPress audit logging to track post creation and edits by contributor and author roles.
- Deploy a Content Security Policy (CSP) that blocks inline scripts and reports violations to a monitoring endpoint.
- Alert on administrator sessions that execute privileged actions immediately after rendering contributor-authored content.
How to Mitigate CVE-2025-46235
Immediate Actions Required
- Identify all WordPress sites running the SKT Blocks plugin and inventory the installed version.
- Restrict contributor and author account creation until a patched release is installed and verified.
- Review recently published or edited posts for suspicious script content in SKT Blocks blocks.
Patch Information
At the time of this writing, the vulnerability affects SKT Blocks through version 2.0 and no patched version is listed in the NVD record. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for a fixed release, and apply updates as soon as they become available.
Workarounds
- Deactivate and remove the SKT Blocks plugin until a vendor patch is published.
- Enforce a strict Content Security Policy that disallows inline script execution on front-end and admin pages.
- Limit untrusted users to roles below contributor, or require editorial review of all contributor-submitted content before publication.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
