CVE-2026-7475 is a stored cross-site scripting vulnerability in the Sky Addons – Elementor Addons with Widgets & Templates WordPress plugin. The vulnerability exists because the `sky-custom-scripts` custom post type is registered with `capability_type => 'post'` and `show_in_rest => true`, combined with insufficient sanitization of the `sky_script_content` meta field and missing output escaping when rendering scripts on the frontend. This allows authenticated users with Author-level access or higher to inject arbitrary JavaScript via the REST API, which executes for all site visitors on frontend pages. The CVSS 3.1 base score is 6.4 (medium), with network attack vector, low attack complexity, privileges required at the Author level, no user interaction, and impacts confidentiality and integrity with no availability impact. There is no vendor advisory or patch available at this time.

An attacker with Author-level or higher privileges can inject malicious scripts that execute in the browsers of all site visitors, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability impacts confidentiality and integrity but does not affect availability. Because the scripts execute on every frontend page, the attack surface includes all visitors to the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or limiting the use of the Sky Addons plugin if possible. Monitor for updates from the vendor and apply official patches when released.