Stored Cross-Site Scripting Vulnerability in Recent Posts Widget Extended for WordPress

CVE-2025-6757

What is CVE-2025-6757?

The Recent Posts Widget Extended plugin for WordPress contains a Stored Cross-Site Scripting vulnerability through the 'rpwe' shortcode. This issue arises from inadequate sanitization and escaping of user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. These scripts can be executed on any page visited by a user, posing serious security risks. This vulnerability affects all versions up to and including 2.0.2, emphasizing the need for immediate attention to secure WordPress installations.

References