Stored Cross-Site Scripting Vulnerability in Recent Posts Widget Extended for WordPress

CVE-2025-6757

What is CVE-2025-6757?

The Recent Posts Widget Extended plugin for WordPress contains a Stored Cross-Site Scripting vulnerability through the 'rpwe' shortcode. This issue arises from inadequate sanitization and escaping of user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. These scripts can be executed on any page visited by a user, posing serious security risks. This vulnerability affects all versions up to and including 2.0.2, emphasizing the need for immediate attention to secure WordPress installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References