The vulnerability CVE-2025-60177 in the rozx Recaptcha – wp plugin (versions up to 0.2.6) is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows an attacker with high privileges and requiring user interaction to inject malicious scripts that persist on the affected system, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, and scope change.

Successful exploitation of this vulnerability can lead to partial disclosure of information, modification of data, and disruption of service due to the stored XSS nature. The attacker must have high privileges and user interaction is required, which limits the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access and exercise caution with user-generated content in the affected plugin. Monitor vendor channels for updates regarding patches or official mitigations.