Stored Cross-Site Scripting Vulnerability in Surbma Recent Comments Shortcode Plugin

CVE-2025-7649

What is CVE-2025-7649?

The Surbma Recent Comments Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes within the ‘recent-comments’ shortcode. This vulnerability allows authenticated users with contributor-level access and above to inject arbitrary web scripts, which can execute on pages viewed by other users. Effective security measures must be implemented to prevent unauthorized script execution and protect user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References