EUVD-2026-28543
GHSA-59rm-h9h8-h9gh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capability_type => 'post' and show_in_rest => true, combined with insufficient input sanitization on the sky_script_content meta field and lack of output escaping when rendering scripts on the frontend. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts via the REST API that execute on every frontend page for all site visitors.
AnalysisAI
Stored cross-site scripting in Sky Addons plugin for WordPress (versions up to 3.3.2) allows authenticated attackers with Author-level access to inject arbitrary JavaScript via the REST API that persists in the sky-custom-scripts post type and executes on all frontend pages for every site visitor. The vulnerability stems from insufficient input sanitization on the sky_script_content meta field combined with lack of output escaping during frontend rendering. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires only Author-level privileges and standard REST API access, making it a practical threat in multi-user WordPress environments.
Technical ContextAI
The Sky Addons plugin registers a custom post type sky-custom-scripts with capability_type => 'post' (inheriting standard post capabilities) and show_in_rest => true, exposing it to modification via the WordPress REST API. Authors and above can create or modify posts of this type via REST endpoints without additional capability checks. The plugin stores custom JavaScript code in the sky_script_content meta field without sanitization before database storage and fails to escape this content when outputting it via the sky-custom-scripts-loader component during frontend rendering. This combines a privilege escalation vector (REST API exposure to lower-privileged roles) with classic stored XSS (CWE-79). The vulnerability affects the entire custom-scripts subsystem responsible for injecting user-supplied JavaScript into the public-facing website.
RemediationAI
Update Sky Addons plugin to version 3.3.3 or later, which includes fixes visible in the trunk and 3.3.3 tag references (class-custom-scripts-data.php line 134 and class-custom-scripts-loader.php line 237 show corrected code). Visit the plugin's WordPress repository page or use the WordPress admin dashboard automatic update feature to fetch the latest version. Wordfence provides detailed advisory and remediation guidance at https://www.wordfence.com/threat-intel/vulnerabilities/id/cfaa8ffd-549e-4803-aa17-d1317a606e7a. As a temporary compensating control pending update, restrict Author-level REST API access to the sky-custom-scripts post type using a capability filtering plugin or WAF rules, limiting modifications to Administrator role only; this reduces attack surface but may break legitimate workflows if non-admin users rely on script management. Alternatively, audit existing custom scripts in the WordPress admin for suspicious injected code before patching, as any malicious scripts created during the window of vulnerability will persist until manually removed.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today