The Surbma | Recent Comments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘recent-comments’ shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-7649 |
Exploitation
To exploit this vulnerability, an attacker with contributor-level access can craft a malicious ‘recent-comments’ shortcode that includes arbitrary JavaScript. When a user accesses a page containing this shortcode, the injected script will execute in the context of the user’s browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- Surbma | Recent Comments Shortcode plugin (all versions up to and including 2.0): Vulnerable to stored XSS due to insufficient input sanitization.
Mitigation
To mitigate this vulnerability, it is recommended to update the Surbma | Recent Comments Shortcode plugin to the latest version where the issue has been addressed. Additionally, implementing proper input validation and output escaping for user-supplied data can help prevent similar vulnerabilities.