CVE-2026-2374 describes a stored cross-site scripting vulnerability in the Login No Captcha reCAPTCHA WordPress plugin (up to version 1.8.0). The vulnerability arises from the authenticate() function storing the unsanitized basename of $_SERVER['PHP_SELF'] in the login_nocaptcha_error WordPress option when login attempts occur from non-standard pages like xmlrpc.php. The admin_notices() function then outputs this stored value directly into the admin dashboard HTML without escaping, allowing injection of arbitrary scripts. This can be triggered by unauthenticated attackers and affects administrators with whitelisted IPs who visit the dashboard shortly after the attack.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of the WordPress admin dashboard. This can lead to limited confidentiality and integrity impacts, such as theft of admin session tokens or manipulation of admin interface content. The vulnerability does not impact availability. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, no privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the WordPress admin dashboard to trusted IPs and monitor for suspicious activity. Avoid visiting the admin dashboard from untrusted networks during the vulnerability window. Follow updates from the plugin vendor or WordPress security channels for patch availability.