Skt Skill Bar Vulnerabilities

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `chart_size` attribute of the `skillwrapper` shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the `chart_size` attribute, which is concatenated directly i...

CVSS:

6.4

Affected:

up to 2.6

Fixed in:

2.7

Disclosed:

Aug 4, 2026

CVE-2026-6972 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based XSS.This issue affects SKT Skill Bar: from n/a through <= 2.5.

Affected:

up to 2.5

Fix:

No patched version reported

Disclosed:

Nov 21, 2025

CVE-2025-66090 on NVD →

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.5

Fixed in:

2.6

Disclosed:

Nov 14, 2025

CVE-2025-66090 on NVD →

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

May 7, 2025

CVE-2025-47482 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar allows Stored XSS. This issue affects SKT Skill Bar: from n/a through 2.4.

Affected:

up to 2.5

Fixed in:

2.5

Disclosed:

May 7, 2025

CVE-2025-47482 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar allows Stored XSS. This issue affects SKT Skill Bar: from n/a through 2.3.

Affected:

up to 2.4

Fixed in:

2.4

Disclosed:

Apr 15, 2025

CVE-2025-26880 on NVD →

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.3

Fixed in:

2.4

Disclosed:

Apr 11, 2025

CVE-2025-26880 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Skill Bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through 2.0.

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

Jul 20, 2024

CVE-2024-38698 on NVD →

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.0

Fixed in:

2.1

Disclosed:

Jul 11, 2024

CVE-2024-38698 on NVD →