CVE-2026-4512: 
WordPress vulnerability analysis and mitigation

CVE-2026-4512 is a stored Cross-Site Scripting (XSS) vulnerability in the "reCaptcha by WebDesignBy" WordPress plugin affecting all versions before 2.0. The flaw allows authenticated administrators on WordPress multisite installations (lacking the unfiltered_html capability) to inject arbitrary JavaScript via the Site Key setting, which then executes for all visitors to the WordPress login page. It was publicly disclosed on April 2, 2026, and carries a CVSS v3.1 base score of 3.5 (Low) (WPScan, GitHub Advisory).

The root cause is improper output encoding (CWE-79): the plugin's grecaptcha_js() function outputs the administrator-supplied Site Key value directly into a JavaScript string context without sanitization or escaping. In a standard single-site WordPress installation, only users with the unfiltered_html capability (typically Super Admins) can inject raw HTML/JS, but this plugin bypasses that control by embedding unsanitized input into JavaScript rather than HTML. On multisite installations, site-level administrators who lack unfiltered_html can exploit this by navigating to Settings > reCaptcha and entering a malicious payload in the Site Key field, causing it to be stored and rendered to all login page visitors (WPScan, GitHub Advisory).

Successful exploitation allows an attacker with site administrator privileges on a WordPress multisite installation to persistently inject malicious JavaScript that executes in the browsers of all users visiting the WordPress login page. This can be leveraged for credential harvesting, session hijacking, phishing, or malware distribution targeting every user who attempts to log in. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per the CVSS scoring (WPScan, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit at this time. The EPSS score is approximately 0.009% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access as a site administrator on a multisite WordPress installation, significantly limiting the attack surface (GitHub Advisory, WPScan).

1. Identify target: Locate a WordPress multisite installation running the "reCaptcha by WebDesignBy" plugin at a version below 2.0, where the attacker has site administrator credentials but lacks the unfiltered_html capability.
2. Authenticate: Log in to the WordPress admin dashboard as a site administrator on the multisite network.
3. Navigate to plugin settings: Go to Settings > reCaptcha in the WordPress admin panel.
4. Inject malicious payload: Enter a JavaScript payload in the Site Key field, such as ";alert(document.cookie);// or a more sophisticated payload designed to exfiltrate credentials or session tokens to an attacker-controlled server.
5. Save settings: Submit the form to store the malicious payload in the WordPress database.
6. Payload execution: When any user visits the WordPress login page (/wp-login.php), the grecaptcha_js() function outputs the unsanitized Site Key into a JavaScript string context, causing the injected script to execute in the visitor's browser (WPScan).

• Logs: WordPress admin audit logs showing changes to the reCaptcha plugin's Site Key setting, particularly entries from site-level administrators on multisite installations; web server access logs showing unusual outbound requests from the login page to external domains.
• File System / Database: Suspicious or encoded JavaScript content stored in the WordPress options table under the reCaptcha plugin's Site Key option (e.g., wp_options table, option name related to webdesignby-recaptcha).
• Network: Outbound HTTP requests from users' browsers to unknown external domains originating from the WordPress login page (/wp-login.php); unexpected POST requests to attacker-controlled endpoints containing cookie or credential data.
• Browser/Client: JavaScript errors or unexpected network requests visible in browser developer tools when loading the WordPress login page.

Update the "reCaptcha by WebDesignBy" WordPress plugin to version 2.0 or later, which includes proper sanitization and escaping of the Site Key setting before output (WPScan). As an interim measure, restrict access to plugin settings to trusted administrators only and audit the current Site Key value in the plugin settings for any suspicious content. On WordPress multisite installations, network administrators should review which site administrators have access to plugin configuration and consider removing the plugin if it is not actively needed until patching is possible.

The vulnerability was discovered and reported by security researcher Mustafa Ahmed of Fortress MSSP and verified by WPScan (WPScan). A technical write-up was published by Infinit Security (Infinit Security). No significant broader media coverage or notable community debate has been observed, consistent with the low severity rating and limited exploitability of this vulnerability.