Stored Cross-Site Scripting in Simple CAPTCHA Plugin for WordPress

CVE-2026-93900

What is CVE-2026-93900?

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping of the 'id' attribute in the [gravity-simple-turnstile] shortcode. Specifically, the function that handles this shortcode, cfturnstile_gravity_shortcode(), applies limited filtering methods that do not adequately secure potentially harmful input. Authenticated attackers with contributor-level access can exploit this vulnerability to inject arbitrary scripts into pages, leading to the execution of these scripts whenever users visit the affected pages.

References