CVE-2025-60138: SKT Blocks Stored XSS Vulnerability

CVE-2025-60138 Overview

CVE-2025-60138 is a stored Cross-Site Scripting (XSS) vulnerability in the SKT Blocks WordPress plugin developed by sonalsinha21. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. It affects all versions of SKT Blocks up to and including 2.6. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages.

Critical Impact
Authenticated contributors can store malicious scripts that execute in visitors' browsers, enabling session theft, redirection, and administrative account takeover through cross-context scripting.

Affected Products

SKT Blocks WordPress plugin (skt-blocks) versions up to and including 2.6
WordPress sites where the plugin is installed and activated
Publisher: sonalsinha21

Discovery Timeline

2025-09-26 - CVE-2025-60138 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60138

Vulnerability Analysis

The SKT Blocks plugin extends the WordPress block editor with additional Gutenberg blocks. Block attributes accepted from the editor are rendered into post output without sufficient sanitization or output escaping. An authenticated user with post-editing privileges can craft a block that stores an attacker-controlled JavaScript payload in the database.

Because the payload is stored, it executes each time a visitor loads the affected page. The scope-changed impact indicates the injected script can affect security contexts beyond the vulnerable component, including the WordPress administrative dashboard when a privileged user views the content.

Root Cause

The vulnerability originates from missing input sanitization on block attributes and missing output escaping when those attributes are rendered into the page. WordPress provides helper functions such as wp_kses_post(), esc_attr(), and esc_html() for this purpose. The affected plugin code paths do not apply these functions to attacker-controlled fields before echoing them into rendered HTML.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit content, and user interaction from a victim who loads the poisoned page. The attacker inserts a malicious payload into a vulnerable block attribute, saves the post, and waits for administrators or site visitors to trigger the payload. Once executed, the script runs with the victim's session context and can perform actions such as cookie theft, CSRF against admin endpoints, or account creation.

Refer to the Patchstack Vulnerability Report for the technical write-up.

Detection Methods for CVE-2025-60138

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_posts content or postmeta rows written by SKT Blocks.
New or modified WordPress administrator accounts following content edits by low-privileged users.
Outbound requests from browser sessions to unfamiliar domains after loading pages that embed SKT Blocks output.

Detection Strategies

Audit rendered post content for HTML tags or attributes that should not appear in editor-supplied block fields.
Review the plugin inventory for skt-blocks at version 2.6 or earlier and flag installations that have not been updated.
Correlate content-modification events in the WordPress audit log with subsequent privilege changes or plugin installations.

Monitoring Recommendations

Enable a web application firewall (WAF) ruleset that inspects POST bodies to /wp-admin/post.php and the REST API for XSS payloads.
Log and alert on outbound HTTP requests from administrative browser sessions to non-approved domains.
Monitor WordPress user role changes and new plugin installations, which are common post-exploitation actions for stored XSS.

How to Mitigate CVE-2025-60138

Immediate Actions Required

Update the SKT Blocks plugin to a version later than 2.6 once the vendor releases a fix, or deactivate and remove the plugin.
Restrict content-authoring roles to trusted users and enforce multi-factor authentication for all accounts with edit privileges.
Scan existing posts and postmeta for stored script payloads and remove any malicious entries.

Patch Information

At the time of publication, the enriched CVE data references the Patchstack Vulnerability Report as the authoritative advisory. Verify the plugin changelog for a version above 2.6 before applying updates in production.

Workarounds

Deactivate the SKT Blocks plugin until a patched release is available.
Apply a virtual patch through a WordPress-aware WAF to block XSS payloads targeting SKT Blocks endpoints.
Reduce the number of accounts with edit_posts capability and revoke access for inactive contributors.

bash

# Identify installed plugin version and disable it via WP-CLI
wp plugin get skt-blocks --field=version
wp plugin deactivate skt-blocks