A stored cross‑site scripting flaw exists in the WP‑reCAPTCHA‑bp plugin supplied by elrata_. The vulnerability allows an attacker to store malicious script code within the plugin’s input fields. When a page renders that content, the script executes in the visitor’s browser, enabling session hijacking, credential theft, or defacement of the site.

WordPress sites running the WP‑reCAPTCHA‑bp plugin version 4.1 or earlier are affected. The issue applies to any installation of the elrata_ WordPress plugin that has not been updated beyond version 4.1.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability was not listed in the CISA KEV catalog, so there is no evidence of widespread exploitation. Exploitation requires the attacker to supply input that gets stored by the plugin, then persuade a visitor to load the contaminated page. Because the flaw is a stored XSS, only users who view the compromised page suffer the impact.