The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.
References
Configurations
No configuration.
History
23 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 |
23 Apr 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.5 |
23 Apr 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-23 07:16
Updated : 2026-04-23 18:16
NVD link : CVE-2026-4512
Mitre link : CVE-2026-4512
CVE.ORG link : CVE-2026-4512
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')