Log in Start free

Vulnerability · Published Apr 23, 2026 · Assigned by WPScan

CVE-2026-4512WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS

Low 3.5

In plain English

A low-severity cross-site scripting in reCaptcha by WebDesignBy from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 90.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.

Affected products (as reported)

VendorProductVersions
Unknown reCaptcha by WebDesignBy 0 – before 2.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

References