CVE-2026-2374
Received Received - Intake
Stored XSS in Login No Captcha reCAPTCHA WordPress Plugin

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: Wordfence

Description
The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_SELF']` superglobal in all versions up to, and including, 1.8.0. This is due to the `authenticate()` function storing the unsanitized output of `basename($_SERVER['PHP_SELF'])` in the `login_nocaptcha_error` WordPress option when a login attempt is made from a non-standard login page (e.g., xmlrpc.php). The `admin_notices()` function then echoes this stored value directly into the admin dashboard HTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator with a whitelisted IP address visits the WordPress dashboard within 30 seconds of the attack.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-05-28
AI Q&A
2026-05-28
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
robert_peake login_no_captcha_recaptcha to 1.8.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The Login No Captcha reCAPTCHA plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.8.0. This occurs because the plugin's authenticate() function stores an unsanitized value derived from the PHP_SELF server variable into a WordPress option. Later, the admin_notices() function outputs this stored value directly into the admin dashboard HTML without escaping it. As a result, an unauthenticated attacker can inject malicious scripts that execute when an administrator with a whitelisted IP visits the dashboard shortly after the attack.


How can this vulnerability impact me? :

This vulnerability allows unauthenticated attackers to execute arbitrary scripts in the context of the WordPress admin dashboard. This can lead to unauthorized actions such as stealing administrator session cookies, performing actions on behalf of the administrator, or injecting malicious content. Since the attack triggers when an admin visits the dashboard, it can compromise the security and integrity of the WordPress site, potentially leading to further exploitation or data breaches.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart