Vulnerabilities

TI-2026-02009 CVE-2026-2374 · GHSA-m5hx-7xc5-p76f

Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF

LOW 38

The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_SELF']` superglobal in all versions up to, and including, 1.8.0.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00346 Published 2026-05-28 No fix listed CWE-79

TI-2025-31934 CVE-2025-50021 · GHSA-gx9r-jjvf-gv33

WordPress Better Random Redirect plugin <= 1.3.20 - Cross Site Scripting (XSS) Vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Better Random Redirect better-random-redirect allows Stored XSS.This issue affects Better Random Redirect…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00256 Published 2025-06-20 No fix listed CWE-79

Vulnerabilities

Filters

Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF

WordPress Better Random Redirect plugin <= 1.3.20 - Cross Site Scripting (XSS) Vulnerability