SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-4512

LOW · CVSS 3.5 EPSS 0.20%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-04-23 · Last synced 2026-08-04

CyberRota Analysis

This is a low severity vulnerability with a CVSS score of 3.5. It affects WordPress, Java.

CVE
CVE-2026-4512
Severity
LOW
CVSS
3.5
EPSS
0.20%
WordPress Java

Original NVD Description

The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.