The vulnerability is a reflected XSS flaw in the Captchelfie – Captcha by Selfie WordPress plugin. Improper neutralization of input allows a malicious user to inject script that runs in the context of other visitors, potentially compromising account data, session cookies, or performing phishing impersonation. This weakness stems from CWE‑79 and can affect any site that uses the plugin, giving attackers the ability to steal credentials or inject further attacks.

WordPress sites that have the Captchelfie – Captcha by Selfie plugin version 1.0.7 or earlier, including all earlier releases, are impacted. The plugin is managed by trof and distributed via WordPress plugin repository. Versions newer than 1.0.7 are not known to contain this flaw.

The flaw has a CVSS score of 7.1, indicating substantial risk. EPSS is below 1 % so real‑world exploitation is unlikely at present, and the vulnerability is not listed in CISA's KEV catalog. Attackers could exploit it by persuading users to visit a crafted URL or by injecting data into a form that the plugin reflects back. Since no patch is available yet, sites remain exposed until vendor releases a fixed version.