This vulnerability is a reflected cross‑site scripting flaw in the Gotcha │ Gesture‑based Captcha WordPress plugin. The flaw exists because the 'menu' parameter is not properly sanitized or escaped, allowing an attacker to inject arbitrary JavaScript that runs when a victim follows a crafted link. The weakness is a classic input validation issue, identified as CWE‑79, and permits unauthenticated exploitation without needing special permissions. When triggered, the injected script can steal session cookies, deface the page, or redirect the user, compromising confidentiality, integrity, and availability of the site.

The issue affects all installations of the Gotcha │ Gesture‑based Captcha plugin published by Pienaro. Any WordPress site running version 1.0.0 or earlier is vulnerable; newer releases are not mentioned as affected by the vendor.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% shows a very low but non‑zero probability of exploitation. The plugin is not listed in the CISA KEV catalog, which means there are no known active exploits reported. Because the vulnerability can be triggered by an unauthenticated user via a malicious link, the attack vector is most likely social engineering or phishing. An attacker does not need to log in, but relies on user interaction to execute the injected code.