The Alobaidi Captcha plugin for WordPress contains a flaw that allows authenticated administrators or higher to inject arbitrary JavaScript into the plugin’s settings page. Because input is not properly sanitized and output is not escaped, the injected code is stored and will run whenever users view affected pages, creating a stored cross‑site scripting condition. This capability could enable attackers to execute malicious scripts in the browsers of any visitor to the compromised site.

All installations of the Alobaidi Captcha plugin up to and including version 1.0.3 are affected. The vulnerability is present only on WordPress multi‑site networks where the unfiltered_html capability is disabled. Users with administrator or higher roles who can edit the plugin’s settings are able to introduce the malicious payload.

The CVSS score of 4.4 signals a medium overall severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with sufficient privileges, limiting the attack surface to users who can modify the plugin settings. Overall, the risk is moderate for sites with many administrators but remains low for environments with a single or tightly controlled set of privileged accounts.