PT-2026-38904 · WordPress · Sky Addons

Athiwat Tiprasaharn · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-7475

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sky Addons versions prior to 3.3.3

Description The Sky Addons plugin for WordPress allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts. This occurs because the sky-custom-scripts custom post type is registered with capability type => 'post' and show in rest => true, while the sky script content meta field lacks sufficient input sanitization and output escaping during frontend rendering. These scripts are executed on every frontend page for all site visitors via the REST API.

Recommendations Update the plugin to a version later than 3.3.2. As a temporary workaround, restrict access to the REST API or limit user permissions to prevent Author-level users from modifying the sky script content meta field.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7475

Affected Products

Sky Addons

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-7475 · Security Note
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/3.3.2/includes/custom-scripts/class-custom-scripts-loader.php#L270 · Note
• https://t.me/cveNotify/162694 · Telegram Post
• https://t.me/CVEtracker/53109 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052732466037768664 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/trunk/includes/custom-scripts/class-custom-scripts-data.php#L134 · Note
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/trunk/includes/custom-scripts/class-custom-scripts-loader.php#L237 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3521696%40sky-elementor-addons%2Ftrunk&old=3517772%40sky-elementor-addons%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2053174683340570757 · Twitter Post
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/3.3.3/includes/custom-scripts/class-custom-scripts-data.php#L134 · Note
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/3.3.2/includes/custom-scripts/class-custom-scripts-data.php#L128 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cfaa8ffd-549e-4803-aa17-d1317a606e7a?source=cve · Note