The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/6e09e922-983c-4406-8053-747d839995d1/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/6e09e922-983c-4406-8053-747d839995d1/ | Exploit Third Party Advisory |
Configurations
History
05 May 2025, 17:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-352 | |
| References | () https://wpscan.com/vulnerability/6e09e922-983c-4406-8053-747d839995d1/ - Exploit, Third Party Advisory | |
| First Time |
Bozdoz
Bozdoz recaptcha Jetpack |
|
| CPE | cpe:2.3:a:bozdoz:recaptcha_jetpack:*:*:*:*:*:wordpress:*:* |
28 Mar 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
21 Nov 2024, 09:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/6e09e922-983c-4406-8053-747d839995d1/ - |
14 May 2024, 16:11
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-14 15:42
Updated : 2025-05-05 17:06
NVD link : CVE-2024-3941
Mitre link : CVE-2024-3941
CVE.ORG link : CVE-2024-3941
JSON object : View
Products Affected
bozdoz
- recaptcha_jetpack
CWE
CWE-352
Cross-Site Request Forgery (CSRF)