Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.This issue affects Captcha.eu: from n/a through < 1.0.61.
Published: 2025-08-28
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Captcha.eu WordPress plugin contains a reflected XSS flaw due to improper neutralization of input during web page generation. The plugin echoes user‑supplied parameters directly into a page without sanitization, creating an opportunity for reflected cross‑site scripting.

Affected Systems

WordPress sites that have installed the Captcha.eu plugin from vendor captcha.eu and are running any version earlier than 1.0.61 are vulnerable. The flaw is present in all releases prior to 1.0.61.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity risk, while the EPSS score of less than 1 % indicates a low current probability of exploitation. The flaw is a reflected XSS that can be triggered via a crafted URL or malicious link, requiring no authentication or elevated privileges. The vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on May 1, 2026 at 06:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Captcha.eu plugin to version 1.0.61 or newer, which removes the XSS vulnerability.
  • If an upgrade cannot be performed immediately, disable or uninstall the plugin to prevent the vulnerable code from executing.
  • In addition, enforce proper output encoding or sanitization of any user input in the plugin code or via CMS-level settings, following best practice for preventing reflected XSS.

Generated by OpenCVE AI on May 1, 2026 at 06:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-25984 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu allows Reflected XSS. This issue affects Captcha.eu: from n/a through n/a.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu allows Reflected XSS. This issue affects Captcha.eu: from n/a through n/a. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.This issue affects Captcha.eu: from n/a through < 1.0.61.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Thu, 28 Aug 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 28 Aug 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 28 Aug 2025 13:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu allows Reflected XSS. This issue affects Captcha.eu: from n/a through n/a.
Title WordPress Captcha.eu Plugin < 1.0.61 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:26.748Z

Reserved: 2025-07-03T14:51:13.581Z

Link: CVE-2025-53579

cve-icon Vulnrichment

Updated: 2025-08-28T13:28:44.970Z

cve-icon NVD

Status : Deferred

Published: 2025-08-28T13:16:05.203

Modified: 2026-04-23T15:32:38.440

Link: CVE-2025-53579

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T06:30:10Z

Weaknesses