CVE-2026-7475

The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sky-custom-scripts` custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with `capability_type => 'post'` and `show_in_rest => true`, combined with insufficient input sanitization on the `sky_script_content` meta field and lack of output escaping when rendering scripts on the frontend. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts via the REST API that execute on every frontend page for all site visitors.

• CWE-79

• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/3.3.2/includes/custom-scripts/class-custom-scripts-data.php#L128
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/3.3.2/includes/custom-scripts/class-custom-scripts-loader.php#L270
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/3.3.3/includes/custom-scripts/class-custom-scripts-data.php#L134
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/trunk/includes/custom-scripts/class-custom-scripts-data.php#L134
• https://plugins.trac.wordpress.org/browser/sky-elementor-addons/trunk/includes/custom-scripts/class-custom-scripts-loader.php#L237
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3521696%40sky-elementor-addons%2Ftrunk&old=3517772%40sky-elementor-addons%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cfaa8ffd-549e-4803-aa17-d1317a606e7a?source=cve

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7469A vulnerability was detected in Tenda 4G300 US_4G300V1.0Mt_V…6.3
• CVE-2026-7470A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42…8.8
• CVE-2026-7471GitLab has remediated an issue in GitLab EE affecting all ve…3.5
• CVE-2026-7472The Read More & Accordion plugin for WordPress is vulnerable…4.9
• CVE-2026-7473On affected platforms running Arista EOS where a tunnel deca…6.9
• CVE-2026-7474HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vuln…8.8
• CVE-2026-7480An Incorrect Permission Assignment for Critical Resource vul…7.3
• CVE-2026-7481GitLab has remediated an issue in GitLab EE affecting all ve…5.4
• CVE-2026-7482Ollama before 0.17.1 contains a heap out-of-bounds read vuln…9.1
• CVE-2026-7483Local privilege escalation potentially allowed an attacker t…8.5
• CVE-2026-7484External control of Assumed-Immutable web parameter vulnerab…5.3
• CVE-2026-7486Improper neutralization of special elements used in an SQL c…9.8