CVE-2025-6757

Vulnerability

Overview The Recent Posts Widget Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.0.2. The vulnerability resides in the plugin's 'rpwe' shortcode, where user-supplied attributes are not properly sanitized or escaped before being output. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts [1].

Exploitation

Conditions To exploit this vulnerability, an attacker must have at least contributor-level access to a WordPress site. The attacker can use the 'rpwe' shortcode with crafted attributes containing malicious JavaScript. The injected script is stored in the page or post content and will execute when any user, including administrators, views the affected page. No additional privileges or network position is required beyond the contributor account [1].

Impact

Successful exploitation enables the attacker to inject arbitrary web scripts that execute in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information. The vulnerability is classified as Medium severity with a CVSS v3 score of 6.4 [1].

Mitigation

The plugin has been closed as of September 4, 2025, due to this security issue and is no longer available for download from the WordPress plugin repository. Users are advised to remove the plugin and replace it with an alternative solution. No patch is available [1].