The Secure CAPTCHA plugin for WordPress includes a cross-site request forgery flaw that permits an attacker to submit crafted requests that are processed by the plugin and result in a stored cross‑site scripting injection. Because the payload is stored and executed whenever any user loads the affected data, an attacker can obtain the same privileges as that user, potentially hijacking sessions, stealing data, or defacing content.

WordPress sites that have the uosiu Secure CAPTCHA plugin installed with a version of 1.2 or earlier are affected. The vulnerability exists from the earliest release up through version 1.2.

The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% points to a low exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to convince an authenticated user to submit a malicious request—most likely via a phishing link or compromised site—leveraging the CSRF flaw to write arbitrary JavaScript into the plugin’s storage. After injection, the script runs on subsequent page views, giving the attacker the same privileges as the victim. Given the moderate CVSS, low EPSS, and absence from KEV, the risk remains significant but not critical, warranting timely remediation.