Hcaptcha For Forms And More Vulnerabilities

The hCaptcha for WP plugin for WordPress is vulnerable to Bypass Vulnerability in all versions up to, and including, 5.3.0. This is due to form action registrations stored exclusively in a WordPress transient that could expire or be evicted, causing get_registered_form() to return null and skip the hCaptcha requirement...

CVSS:

7.3

(Wordfence)

Affected:

up to 5.3.0

Fixed in:

5.4.0

Disclosed:

Oct 1, 2026

CVE-2026-103347 on NVD →

The hCaptcha for WP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.22.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 4.22.0

Fixed in:

4.23.0

Disclosed:

Jan 26, 2026

CVE-2026-25315 on NVD →

The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit...

CVSS:

6.4

(Wordfence)

Affected:

up to 4.0.0

Fixed in:

4.0.1

Disclosed:

Apr 19, 2024

CVE-2024-4014 on NVD →