CVE-2026-6972 in SKT Skill Bar Plugin
Summary
by MITRE • 08/05/2026
The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `chart_size` attribute of the `skillwrapper` shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the `chart_size` attribute, which is concatenated directly into an inline `<style>` block. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The SKT Skill Bar plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 2.6, creating a significant security risk for WordPress installations. This vulnerability resides within the skillwrapper shortcode implementation where the chart_size attribute fails to undergo proper input sanitization and output escaping processes. The flaw allows authenticated attackers with Contributor-level permissions or higher to inject malicious scripts that persist in the system and execute whenever affected pages are accessed by other users.
The technical exploitation occurs through the direct concatenation of the unsanitized chart_size attribute into an inline style block, which violates fundamental security principles for handling user-supplied data. This vulnerability is classified as a stored XSS flaw under CWE-79, which specifically addresses cross-site scripting vulnerabilities where malicious scripts are stored on the server and executed when users access compromised pages. The vulnerability's impact is amplified by the fact that it requires only Contributor-level privileges, making it accessible to users who typically have limited administrative capabilities.
The operational implications of this vulnerability extend beyond simple script execution, as it enables attackers to perform a wide range of malicious activities including session hijacking, data theft, and redirection to malicious sites. When an attacker with sufficient privileges injects malicious code through the chart_size parameter, the injected scripts execute in the context of the victim's browser, potentially allowing for complete compromise of user sessions and access to sensitive information. This vulnerability can be particularly dangerous in environments where multiple users with varying permission levels interact with the same WordPress installation.
Mitigation strategies should focus on immediate patching of the plugin to version 2.7 or later, which addresses the input sanitization issues. Additionally, administrators should implement proper input validation and output escaping mechanisms for all user-supplied parameters, particularly those used in dynamic style generation. The vulnerability demonstrates the importance of following secure coding practices such as those outlined in the OWASP Top Ten and the ATT&CK framework's techniques for command injection and XSS exploitation. Organizations should also consider implementing content security policies and restricting Contributor-level permissions where possible to minimize the attack surface. Regular security audits and input validation testing remain essential for identifying similar vulnerabilities in other plugins and themes within WordPress ecosystems, as this flaw represents a common pattern of insufficient sanitization in web applications.