Surbma | MiniCRM Shortcode

Surbma | MiniCRM Shortcode has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Surbma | MiniCRM Shortcode has a vendor fix available, so running the current release closes it.

All of these findings were reported by zakaria. Surbma | MiniCRM Shortcode is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Surbma | MiniCRM Shortcode vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-11800

Surbma | MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2025-11-20 19:21	Surbma \| MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Surbma <= 2.0	`CVE-2025-11800`	6.4 Medium	zakaria	Yes

Showing 1–1 of 1 reports

Latestv2.0.1

Surbma | MiniCRM Shortcode

Author

Surbma

0.0(0)

0/100

Last Updated

2026-04-12 (5mo ago)

Active Installs

10+

Downloads

1,820

Requires WP

5.1+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2014-12-10 (12y ago)

A simple shortcode to include MiniCRM forms into WordPress. This is a very useful plugin if your user don’t have a permission to embed javascript in the content. The shortcode: [minicrm id="THIS_IS_THE_ID"] Where id is the MiniCRM form id, that you want to display. You can find the id at the end of your MiniCRM form script:

View on WordPress.org