CVE-2026-6972 is a stored cross-site scripting vulnerability in the SKT Skill Bar WordPress plugin by sonalsinha21. The issue exists in all versions up to and including 2.6, where the chart_size attribute of the skillwrapper shortcode is not properly sanitized or escaped before being inserted into an inline style block. This allows authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to information disclosure, session hijacking, or other actions permitted by the injected script. The vulnerability does not affect availability and requires some level of authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the SKT Skill Bar plugin if possible to mitigate risk.