Vulnerability in ReCaptcha Integration for WordPress Plugin Could Lead to Cross-Site Scripting

CVE-2024-8739

Summary

The ReCaptcha Integration for WordPress plugin is susceptible to Reflected Cross-Site Scripting (XSS) due to inadequate escaping of the URL in the add_query_arg function. Instances of this vulnerability exist in all versions up to and including 1.2.5. This flaw allows attackers without authentication to inject malicious web scripts into web pages, which can be executed if a user is manipulated into taking a specific action, such as clicking a link. This vulnerability has significant implications for user security and data integrity on affected WordPress sites.

References