CVE-2026-6972

Name of the Vulnerable Software and Affected Versions SKT Skill Bar versions prior to 2.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the chart size attribute within the skillwrapper shortcode. The attribute is concatenated directly into an inline <style> block, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page.

Recommendations Update to a version newer than 2.6. As a temporary mitigation, restrict the use of the chart size attribute in the skillwrapper shortcode.