The Sky Addons plugin for WordPress registers a custom post type `sky-custom-scripts` with `capability_type` set to 'post' and `show_in_rest` enabled. Due to insufficient sanitization of the `sky_script_content` meta field and lack of output escaping when rendering these scripts on the frontend, authenticated users with Author-level privileges or higher can inject arbitrary JavaScript via the REST API. This stored XSS vulnerability allows injected scripts to execute in the context of every frontend page, potentially impacting all site visitors.

An attacker with Author-level access or higher can inject malicious scripts that execute on every frontend page viewed by site visitors. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the context of the affected website. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions with the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or restricting the use of the vulnerable custom post type if possible. Monitor official wowdevs communications for updates and apply patches promptly once released.