CVE-2025-11800: Surbma MiniCRM WordPress Plugin XSS Flaw

CVE-2025-11800 Overview

CVE-2025-11800 is a Stored Cross-Site Scripting (XSS) vulnerability in the Surbma | MiniCRM Shortcode plugin for WordPress. The flaw affects all plugin versions up to and including 2.0. It resides in the id shortcode attribute of the minicrm shortcode, where the plugin fails to properly sanitize input and escape output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser context of any visitor who loads the affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, redirects, and administrative account takeover through targeted payloads.

Affected Products

Surbma | MiniCRM Shortcode plugin for WordPress — all versions up to and including 2.0
WordPress sites where contributor-level or higher accounts can author content containing the minicrm shortcode
Any downstream site that renders content authored by an untrusted contributor using the plugin

Discovery Timeline

2025-11-21 - CVE-2025-11800 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11800

Vulnerability Analysis

The Surbma | MiniCRM Shortcode plugin registers a minicrm shortcode that accepts an id attribute supplied by the content author. The plugin echoes this attribute value into the rendered page without sufficient sanitization or output escaping. A contributor who inserts the shortcode with a malicious id attribute produces HTML that carries attacker-controlled JavaScript into the final page.

Because the payload is stored inside post content, execution is persistent. Every visitor who loads the page triggers the injected script under the site's origin. That access enables cookie theft when session cookies are not marked HttpOnly, forced browser actions against the WordPress REST API, and DOM manipulation of the rendered page. If an administrator previews or opens an affected page while authenticated, the payload can act on their behalf.

The issue requires authentication at the contributor level or above, which limits fully external exploitation but does not prevent abuse in multi-author environments, membership sites, or platforms that grant contributor rights during onboarding.

Root Cause

The root cause is missing input sanitization on the id shortcode attribute and missing output escaping when the attribute is written to the HTML response. Standard WordPress helpers such as sanitize_text_field() for input and esc_attr() or esc_html() for output were not applied to this parameter in the vulnerable code path referenced in the plugin's surbma-minicrm-shortcode.php file.

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker creates or edits a post containing the minicrm shortcode and supplies an id value crafted to break out of the intended attribute context. When the post is rendered, either through preview, publication, or administrative review, the payload executes in the browser of the viewer. No user interaction beyond loading the page is required. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the exact vulnerable location.

No public proof-of-concept exploit code is referenced in the vulnerability data. The technical mechanism is standard reflected-into-stored XSS through an unescaped shortcode attribute.

Detection Methods for CVE-2025-11800

Indicators of Compromise

Post or page content containing the [minicrm id="..."] shortcode where the id value includes HTML metacharacters such as <, >, ", or '
Presence of <script>, onerror=, onload=, or javascript: substrings inside rendered minicrm shortcode attributes
Unexpected outbound requests from site visitors to attacker-controlled domains originating from pages that use the shortcode
New administrator accounts or role changes shortly after contributor-authored content containing the shortcode is published

Detection Strategies

Scan the wp_posts table for content matching the pattern %[minicrm %id=%<% or similar shortcode payloads with embedded markup
Review web server access logs for requests to pages containing the minicrm shortcode followed by anomalous JavaScript-driven activity
Inspect Content Security Policy (CSP) violation reports for inline script executions on pages that render the shortcode

Monitoring Recommendations

Enable audit logging for post creation and edits by contributor and author roles
Monitor plugin inventory for the Surbma | MiniCRM Shortcode plugin at version 2.0 or below
Alert on any administrator session that renders a page containing untrusted shortcode content authored by a non-administrator

How to Mitigate CVE-2025-11800

Immediate Actions Required

Deactivate the Surbma | MiniCRM Shortcode plugin on any WordPress site until a patched release is confirmed available
Audit all posts and pages for the minicrm shortcode and remove or sanitize any id attributes containing HTML or script markup
Restrict contributor and author role assignment to trusted users and review recent role changes
Rotate administrator session cookies and require password resets if any injected content was rendered by privileged users

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed version is identified in the enrichment data. Consult the Wordfence Vulnerability Report and the WordPress Plugin repository for the current patch status before reinstalling the plugin.

Workarounds

Remove the plugin entirely if MiniCRM shortcode functionality is not business-critical
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to wp-admin/post.php containing [minicrm alongside <script, onerror=, or javascript: substrings
Enforce a strict Content Security Policy that disallows inline scripts and unknown script sources on the front end
Downgrade contributor and author roles to a custom role without the unfiltered_html capability and without shortcode-heavy publishing rights

bash

# Configuration example: WordPress CLI audit for the vulnerable shortcode
wp post list --post_type=any --format=ids \
  | xargs -I {} wp post get {} --field=post_content \
  | grep -E '\[minicrm[^]]*id="[^"]*[<>"'\''][^"]*"'