CVE-2026-93900

MediumCVSS 6.4

Published: 04/11/2026(UTC)Updated: 04/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

27th percentile - higher than 27% of all known CVEs

Summary

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress (versions up to and including 1.44.3) is vulnerable to stored cross-site scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode. This is due to insufficient input sanitization and output escaping in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which removes parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user visits the injected page.

Risk Assessment

An attacker can execute arbitrary scripts in the victim's browser, hijack sessions, or perform actions on their behalf. This poses a risk to WordPress sites with the vulnerable plugin installed.

Recommendation

Update the Simple CAPTCHA with Cloudflare Turnstile plugin to a version newer than 1.44.3 as soon as it becomes available. Until then, restrict content publishing by contributor-role users or disable the plugin.

Other vulnerabilities in Simple CAPTCHA with Cloudflare Turnstile

CVE-2026-15239Medium
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before version 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value. This allows unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection.

Original NVD description (English source)

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which touches parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal (esc_js only escapes quotes, backslashes, and newlines). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS