The ReCaptcha Integration for WordPress plugin suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping on URL parameters in all versions up to 1.2.5. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim is tricked into clicking a malicious link. The vulnerability is tracked as CVE-2024-8739 with a CVSS 3.1 base score of 6.1 (medium severity). No patch or remediation details are currently available, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information or session hijacking. The vulnerability requires user interaction (clicking a crafted link) and does not grant direct system access or denial of service. The impact is limited to confidentiality and integrity at the user session level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid clicking suspicious links that may exploit this vulnerability. Monitoring the vendor's updates for a security patch is recommended.