CVE-2025-23693

CVE-2025-23693 is a Cross-Site Request Forgery (CSRF) vulnerability in the uosiu Secure CAPTCHA WordPress plugin, version secure-captcha, that allows Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through version 1.2 inclusive, as documented under CWE-352.

The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as tricking a user into performing an action via a malicious site. Exploitation changes the scope (S:C) and results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1. An attacker can leverage the CSRF to inject and store an XSS payload, which executes in the context of authenticated users viewing affected pages.

Patchstack has published an advisory detailing the CSRF to Stored XSS vulnerability in Secure CAPTCHA plugin version 1.2, available at https://patchstack.com/database/Wordpress/Plugin/secure-captcha/vulnerability/wordpress-secure-captcha-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve.