CVE-2025-11800

Name of the Vulnerable Software and Affected Versions Surbma | MiniCRM Shortcode plugin for WordPress versions through 2.0

Description The Surbma | MiniCRM Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id shortcode attribute of the minicrm shortcode. This is a result of inadequate input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Update the Surbma | MiniCRM Shortcode plugin to a version beyond 2.0.