The Recaptcha – wp plugin contains improper neutralization of input during web page generation, allowing a stored XSS vulnerability. Based on the description, it is inferred that malicious code can be injected into content handled by the plugin and run in the browsers of any user who views that content, enabling client‑side attacks such as credential theft or defacement.

All WordPress installations that use the Recaptcha – wp plugin from rozx, any release up to and including 0.2.6, are affected. The vulnerability is not tied to a specific WordPress version but to the plugin itself.

The CVSS v3 score of 5.9 indicates a moderate severity assessment, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would typically abuse any data‑entry field exposed by the plugin to store malicious scripts that are subsequently rendered for users who access the affected content.