The vulnerability allows an authenticated user with contributor level or higher to inject arbitrary JavaScript into the site by supplying a malicious value for the 'id' attribute of the [gravity-simple-turnstile] shortcode. The input is only passed through esc_html() and sanitize_text_field(), neither of which removes parentheses or dots, and then output with esc_js() in a raw JavaScript expression context where only quotes, backslashes and newlines are escaped. This flaw enables the attacker to persistently store malicious scripts that will execute in any browser that loads a page containing the shortcode, allowing client‑side code execution and potential theft of session cookies, defacement, or further attacks in the victim’s context.

WordPress sites that use the Simple CAPTCHA with Cloudflare Turnstile plugin, versions up to and including 1.44.3. Any user with contributor‑level or higher privileges can exploit the flaw by adding or editing content that includes the shortcode.

The flaw carries a CVSS score of 6.4, indicating a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with contributor or higher permissions; once a malicious payload is stored, it will run whenever a visitor loads the affected page, exposing the site to persistent client‑side attacks.