CVE-2026-7475 Overview
CVE-2026-7475 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Sky Addons plugin for WordPress. The flaw affects all versions up to and including 3.3.2. The vulnerability resides in the sky-custom-scripts custom post type, which is registered with capability_type => 'post' and show_in_rest => true. Authenticated attackers with Author-level access or higher can inject arbitrary JavaScript through the REST API. The injected scripts execute on every frontend page for all site visitors, enabling session hijacking, credential theft, and drive-by redirection.
Critical Impact
Author-level users can persist arbitrary JavaScript that runs in every visitor's browser, including authenticated administrators, enabling account takeover and full site compromise.
Affected Products
- Sky Addons for WordPress (also known as Sky Elementor Addons), versions up to and including 3.3.2
- WordPress sites running the plugin with the sky-custom-scripts post type enabled
- Any site permitting Author-level or higher registration with the plugin installed
Discovery Timeline
- 2026-05-08 - CVE-2026-7475 published to NVD
- 2026-05-08 - Last updated in NVD database
Technical Details for CVE-2026-7475
Vulnerability Analysis
The Sky Addons plugin registers a custom post type named sky-custom-scripts intended to let administrators embed JavaScript snippets on the frontend. The registration uses capability_type => 'post', which grants any user with default post-editing capabilities (Author and above) the ability to create and edit these entries. Combined with show_in_rest => true, this exposes the post type through the WordPress REST API.
The plugin reads the sky_script_content meta field and writes its value directly into the rendered HTML on the frontend. Neither input sanitization on write nor output escaping on read is applied. As a result, an Author-level account can publish a sky-custom-scripts entry containing a <script> block, and that script will execute for every visitor that loads any page where the script is emitted by the loader in class-custom-scripts-loader.php.
Root Cause
The root cause is twofold. First, the custom post type uses a generic capability mapping that lets low-privilege contributors create entries intended for administrators only. Second, the sky_script_content meta value is treated as trusted output rather than untrusted user input, bypassing WordPress escaping functions such as wp_kses or esc_html.
Attack Vector
An attacker authenticates with an Author or higher account and sends a POST request to the WordPress REST API endpoint for the sky-custom-scripts post type. The request body includes a sky_script_content meta value containing JavaScript. Once saved and rendered by the script loader, the payload runs in the browser of every site visitor on every frontend page. See the WordPress Plugin Script Loader source and the Wordfence Vulnerability Report for technical details on the vulnerable code paths.
Detection Methods for CVE-2026-7475
Indicators of Compromise
- Presence of sky-custom-scripts post type entries authored by non-administrator accounts
- Unexpected <script> tags rendered globally on frontend pages tied to plugin output
- REST API requests to /wp-json/wp/v2/sky-custom-scripts originating from Author or Editor accounts
- Outbound requests from visitor browsers to attacker-controlled domains shortly after page load
Detection Strategies
- Audit the wp_posts table for entries with post_type = 'sky-custom-scripts' and review the associated sky_script_content meta values for HTML or JavaScript payloads
- Review web server access logs for POST and PUT requests to the plugin's REST API endpoints from non-administrator users
- Compare current plugin file hashes against the 3.3.3 release to confirm version state
Monitoring Recommendations
- Alert on any creation or update of sky-custom-scripts posts by accounts below Administrator role
- Monitor outbound traffic from web servers for anomalous third-party script domains served to clients
- Track new low-privilege account registrations followed by REST API write activity within short time windows
How to Mitigate CVE-2026-7475
Immediate Actions Required
- Update the Sky Addons plugin to version 3.3.3 or later, which addresses the input handling and output escaping issues
- Review all existing sky-custom-scripts entries and remove any created by non-administrator accounts
- Rotate administrator credentials and invalidate active sessions if unauthorized script content is discovered
- Restrict user registration and audit Author-level accounts for legitimacy
Patch Information
The vendor released version 3.3.3 of the Sky Elementor Addons plugin, which corrects the capability mapping and adds proper escaping for the sky_script_content meta field. Refer to the WordPress Plugin Changeset and the updated class-custom-scripts-data.php in 3.3.3 for the fix details.
Workarounds
- Disable or uninstall the Sky Addons plugin until the update can be applied
- Restrict the edit_posts capability for Author-level users via a role management plugin if the plugin must remain active
- Apply a Web Application Firewall rule that blocks REST API write requests to /wp-json/wp/v2/sky-custom-scripts from non-administrator sessions
- Implement a Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
