Vulnerabilities and security researches forskt-skill-bar skt-skill-bar

Jul 15, 2024

CVE, Research URL: CVE-2024-38698
Home page URL: Security reports for SKT Skill Bar
Application: SKT Skill Bar
Date: Jul 20, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Skill Bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through 2.0.
Affected versions: max 2.1.
Status: vulnerable

Apr 15, 2025

CVE, Research URL: CVE-2025-26880
Home page URL: Security reports for SKT Skill Bar
Application: SKT Skill Bar
Date: Apr 16, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through <= 2.3.
Affected versions: max 2.4.
Status: vulnerable

May 09, 2025

CVE, Research URL: CVE-2025-47482
Home page URL: Security reports for SKT Skill Bar
Application: SKT Skill Bar
Date: May 07, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through <= 2.4.
Affected versions: max 2.5.
Status: vulnerable

Dec 11, 2025

CVE, Research URL: CVE-2025-66090
Home page URL: Security reports for SKT Skill Bar
Application: SKT Skill Bar
Date: Nov 21, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based XSS.This issue affects SKT Skill Bar: from n/a through <= 2.5.
Affected versions: max 2.6.
Status: vulnerable

Aug 06, 2026

CVE, Research URL: CVE-2026-6972
Home page URL: Security reports for SKT Skill Bar
Application: SKT Skill Bar
Date: Aug 05, 2026
Research Description: The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `chart_size` attribute of the `skillwrapper` shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the `chart_size` attribute, which is concatenated directly into an inline `<style>` block. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 2.7.
Status: vulnerable