What is the CVSS score of CVE-2026-57365?

CVE-2026-57365 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

reCAPTCHA for Asgaros Forum CVE-2026-57365

EUVD-2026-43445 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Recaptcha V2 Amp V3 For Asgaros Forum

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-delivered DOM XSS requires low-privilege authentication and victim interaction; availability impact is not a credible outcome of client-side script injection and is assessed as N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:29 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 & v3) for Asgaros Forum: from n/a through <= 1.1.0.

AnalysisAI

DOM-Based Cross-Site Scripting in the reCAPTCHA (v2 & v3) for Asgaros Forum WordPress plugin (all versions through 1.1.0) enables authenticated low-privilege forum users to inject client-side scripts that execute in victims' browsers. The CVSS Scope:Changed metric (S:C) indicates the injected scripts can affect browser contexts beyond the vulnerable plugin component itself - including the broader WordPress session. No public exploit code or active exploitation has been identified at time of analysis, though the vulnerability was disclosed by Patchstack.

Technical ContextAI

The affected component is a third-party WordPress plugin developed by Hitesh Chandwani that integrates Google reCAPTCHA v2 and v3 into the Asgaros Forum plugin. The root cause is CWE-79: Improper Neutralization of Input During Web Page Generation. Specifically, this is a DOM-Based XSS variant, meaning unsanitized attacker-controlled data is processed by client-side JavaScript and written into the live DOM - entirely on the client side. This distinguishes it from stored or reflected XSS, and critically means server-side Web Application Firewalls may not intercept or detect the payload, since the dangerous operation never passes through the server's response body. The CPE string cpe:2.3:a:hitesh_chandwani:recaptcha_(v2_&_v3)_for_asgaros_forum identifies the exact vendor and product scope.

RemediationAI

No confirmed patched version is available from the provided intelligence data - the affected range is stated as 'through <= 1.1.0' with no explicit fix version cited. Administrators should immediately check the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/recaptcha-for-asgaros-forum/vulnerability/wordpress-recaptcha-v2-v3-for-asgaros-forum-plugin-1-1-0-cross-site-scripting-xss-vulnerability and the WordPress plugin repository for an updated release. As a compensating control, deactivating the plugin via WP Admin until a patch is confirmed is the most effective mitigation, with the trade-off that reCAPTCHA spam protection on the Asgaros Forum will be lost. Restricting forum registration to trusted users reduces the PR:L attacker entry point and limits exploitation potential without removing the plugin entirely. A Content Security Policy (CSP) header blocking inline script execution can mitigate DOM XSS impact at the server level, though CSP deployment in WordPress requires careful configuration to avoid breaking other site functionality.