What is the CVSS score of CVE-2026-7475?

CVE-2026-7475 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Sky Addons CVE-2026-7475

EUVD-2026-28543 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 Wordfence

GHSA-59rm-h9h8-h9gh

WordPress XSS Wordpress Plugin Sky Addons Elementor Addons With Widgets Templates Elementor Wowdevs

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 10:30 vuln.today

CVE Published

May 08, 2026 - 09:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capability_type => 'post' and show_in_rest => true, combined with insufficient input sanitization on the sky_script_content meta field and lack of output escaping when rendering scripts on the frontend. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts via the REST API that execute on every frontend page for all site visitors.

AnalysisAI

Stored cross-site scripting in Sky Addons plugin for WordPress (versions up to 3.3.2) allows authenticated attackers with Author-level access to inject arbitrary JavaScript via the REST API that persists in the sky-custom-scripts post type and executes on all frontend pages for every site visitor. The vulnerability stems from insufficient input sanitization on the sky_script_content meta field combined with lack of output escaping during frontend rendering. No public exploit code or active exploitation has been identified at time of analysis, but the attack requires only Author-level privileges and standard REST API access, making it a practical threat in multi-user WordPress environments.

Technical ContextAI

The Sky Addons plugin registers a custom post type sky-custom-scripts with capability_type => 'post' (inheriting standard post capabilities) and show_in_rest => true, exposing it to modification via the WordPress REST API. Authors and above can create or modify posts of this type via REST endpoints without additional capability checks. The plugin stores custom JavaScript code in the sky_script_content meta field without sanitization before database storage and fails to escape this content when outputting it via the sky-custom-scripts-loader component during frontend rendering. This combines a privilege escalation vector (REST API exposure to lower-privileged roles) with classic stored XSS (CWE-79). The vulnerability affects the entire custom-scripts subsystem responsible for injecting user-supplied JavaScript into the public-facing website.

RemediationAI

Update Sky Addons plugin to version 3.3.3 or later, which includes fixes visible in the trunk and 3.3.3 tag references (class-custom-scripts-data.php line 134 and class-custom-scripts-loader.php line 237 show corrected code). Visit the plugin's WordPress repository page or use the WordPress admin dashboard automatic update feature to fetch the latest version. Wordfence provides detailed advisory and remediation guidance at https://www.wordfence.com/threat-intel/vulnerabilities/id/cfaa8ffd-549e-4803-aa17-d1317a606e7a. As a temporary compensating control pending update, restrict Author-level REST API access to the sky-custom-scripts post type using a capability filtering plugin or WAF rules, limiting modifications to Administrator role only; this reduces attack surface but may break legitimate workflows if non-admin users rely on script management. Alternatively, audit existing custom scripts in the WordPress admin for suspicious injected code before patching, as any malicious scripts created during the window of vulnerability will persist until manually removed.