reCaptcha by WebDesignBy CVE-2026-4512

The vulnerability stems from improper output escaping in a WordPress plugin that integrates Google reCaptcha functionality. The grecaptcha_js() function dynamically constructs JavaScript code that loads the reCaptcha library, incorporating the Site Key setting without proper sanitization or escaping. On WordPress multisite installations, site administrators have the ability to modify plugin settings but lack the unfiltered_html capability, which normally prevents direct code execution. This permission model gap allows an attacker with site admin privileges to inject malicious JavaScript into the Site Key field, which gets executed in the context of the grecaptcha.render() call. The injected code runs in the browser of all visitors to the login page, bypassing capability restrictions because the injection occurs at the template/output layer rather than being validated as user input. This is a stored cross-site scripting (XSS) vulnerability with a privileged insertion point.