Stored Cross-Site Scripting Vulnerability in Alobaidi Captcha WordPress Plugin

CVE-2025-8080

What is CVE-2025-8080?

The Alobaidi Captcha plugin for WordPress is susceptible to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping in the plugin settings. This vulnerability allows authenticated attackers with administrator-level permissions to inject malicious scripts into pages. These scripts execute whenever a user accesses a compromised page. The issue primarily affects multi-site installations and those where unfiltered_html capabilities have been restricted, adding a layer of risk for site administrators.

References