The reCaptcha by WebDesignBy WordPress plugin prior to version 2.0 contains a cross-site scripting vulnerability (CWE-79) due to improper sanitization of the Site Key setting. Specifically, the Site Key is output in a JavaScript string context without escaping via the grecaptcha_js() function. This allows users with administrator privileges on multisite installations—who do not have the unfiltered_html capability—to inject arbitrary JavaScript code that executes in the context of the WordPress login page for all visitors. The vulnerability has a CVSS 3.1 base score of 3.5, indicating low severity. There is no vendor advisory or patch information available at this time.

Successful exploitation permits an administrator on a multisite WordPress installation to inject and execute arbitrary JavaScript code on the login page for all visitors. This could lead to limited confidentiality and integrity impacts, such as theft of session information or manipulation of the login page content. However, the attack requires administrator privileges and user interaction (visiting the login page). There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to multisite administrative functions and carefully control who can modify plugin settings. Monitoring for plugin updates and applying them promptly when available is recommended.