Stored Cross-Site Scripting Vulnerability in Login No Captcha reCAPTCHA Plugin for WordPress

CVE-2026-2374

What is CVE-2026-2374?

The Login No Captcha reCAPTCHA plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This security flaw allows an attacker to exploit the $_SERVER['PHP_SELF'] superglobal in the authenticate() function. When a user attempts to log in from a non-standard page, the plugin captures and stores unsanitized data, which can later be injected into the admin dashboard. This risk enables unauthenticated attackers to execute malicious scripts on the dashboard when an administrator accesses it shortly after the attack.

References