The reCaptcha by WebDesignBy WordPress plugin prior to version 2.0 contains a stored cross-site scripting vulnerability (CWE-79) due to improper sanitization of the Site Key setting. Specifically, the Site Key is output directly into JavaScript without escaping in the grecaptcha_js() function. This enables administrators on multisite setups without unfiltered_html privileges to inject malicious JavaScript code that executes in the context of the WordPress login page for all visitors. The vulnerability was published on 2026-04-23, with no CVSS score or remediation level assigned yet.

Successful exploitation allows an attacker with administrator privileges on multisite WordPress installations (but without unfiltered_html capability) to execute arbitrary JavaScript in the login page context. This could lead to session hijacking, credential theft, or other malicious actions affecting all visitors to the login page. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to the Site Key setting and avoid using vulnerable plugin versions on multisite installations. Monitoring for updates from the plugin vendor is recommended.