The vulnerability resides in the Login No Captcha reCAPTCHA WordPress plugin. An unauthenticated attacker can send a crafted login request through a non‑standard login endpoint, such as xmlrpc.php. The plugin's authenticate() function stores basename($_SERVER['PHP_SELF']) without sanitization into the login_nocaptcha_error option. The admin_notices() function later echoes this stored value directly into the admin dashboard, allowing arbitrary JavaScript to run when an administrator accesses the dashboard within 30 seconds of the exploit. This constitutes an unauthenticated stored cross‑site scripting flaw that could be used to steal credentials, deface the site, or perform further privileged actions on the WordPress installation.

WordPress sites running the robertpeake Login No Captcha reCAPTCHA plugin version 1.8.0 or earlier are affected. Administrators with whitelisted IP addresses are required for the payload to execute, but the initial injection does not require authentication.

The CVSS score of 7.2 indicates a high impact, while the EPSS score is not available, making it unclear how frequently exploitation has occurred. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. An attacker can launch the exploit remotely via a non‑standard login interface; the vulnerability does not require any privileged access to record the payload. Because the script executes only shortly after login, the window of opportunity is limited, yet the potential damage remains significant.