CVE-2025-28880: Blue Captcha XSS Vulnerability

CVE-2025-28880 Overview

CVE-2025-28880 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the jotis Blue Captcha WordPress plugin. The flaw exists in blue-captcha versions up to and including 1.7.4. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in a victim's browser. Successful exploitation requires user interaction, typically by tricking a target into clicking a crafted link. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself.

Critical Impact

Attackers can execute arbitrary JavaScript in the browser context of WordPress users who interact with a malicious link, enabling session theft, credential harvesting, and unauthorized actions on behalf of victims.

Affected Products

• jotis Blue Captcha plugin for WordPress
• All versions from n/a through <= 1.7.4
• WordPress sites with the Blue Captcha plugin installed and active

Discovery Timeline

• 2025-03-26 - CVE-2025-28880 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28880

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Blue Captcha WordPress plugin. The plugin accepts input parameters and reflects them back into HTTP responses without adequate sanitization or output encoding. When a victim clicks a crafted URL, the malicious payload renders within the page and executes in the victim's browser session.

Reflected XSS attacks against WordPress plugins are commonly used to hijack administrator sessions. An attacker who compromises an authenticated admin can pivot to broader site compromise, including arbitrary plugin installation and remote code execution on the underlying server.

The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. According to the Patchstack Vulnerability Report, the issue affects all versions up to 1.7.4.

Root Cause

The root cause is missing or insufficient input sanitization on request parameters processed by the plugin. User-controlled data is concatenated into HTML output without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). As a result, script content supplied by an attacker is rendered as executable JavaScript rather than inert text.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL containing a malicious JavaScript payload in a vulnerable parameter handled by the Blue Captcha plugin. The attacker delivers this URL through phishing emails, malicious websites, or social media. When a logged-in WordPress user clicks the link, the payload executes in their browser under the origin of the WordPress site. The injected script can read cookies, manipulate the Document Object Model (DOM), submit forms, or call administrative endpoints on the victim's behalf.

No proof-of-concept exploit has been published publicly, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-28880

Indicators of Compromise

• Web server access logs containing requests with URL parameters that include <script> tags, javascript: URIs, or encoded equivalents targeting Blue Captcha plugin endpoints
• Unexpected outbound requests from administrator browser sessions to attacker-controlled domains
• WordPress admin actions originating from unusual referrers or correlated with crafted external links

Detection Strategies

• Inventory all WordPress installations and identify sites running the Blue Captcha plugin at version 1.7.4 or earlier
• Deploy a Web Application Firewall (WAF) rule that inspects request parameters for XSS payload patterns directed at plugin endpoints
• Review HTTP response bodies for reflected unsanitized input matching parameters from the request

Monitoring Recommendations

• Forward web server and WordPress audit logs to a centralized analytics platform to correlate suspicious URL patterns with user sessions
• Alert on administrator account activity that immediately follows clicks on externally referred links
• Monitor browser-side Content Security Policy (CSP) violation reports for blocked inline script execution attempts

How to Mitigate CVE-2025-28880

Immediate Actions Required

• Update the Blue Captcha plugin to a version newer than 1.7.4 if a patched release is available, per the Patchstack advisory
• Deactivate and remove the Blue Captcha plugin if no fixed version is published and the functionality is not required
• Force a password reset and session invalidation for all WordPress administrator accounts that may have interacted with suspicious links

Patch Information

At the time of publication, the advisory indicates the vulnerability affects Blue Captcha versions up to and including 1.7.4. Site operators should consult the Patchstack Vulnerability Report for the latest patch status and apply the vendor-supplied fix when released.

Workarounds

• Deploy a WAF with rules that block reflected XSS payloads in parameters processed by the Blue Captcha plugin
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Enforce the HttpOnly and SameSite=Strict attributes on WordPress session cookies to reduce the impact of script-based theft
• Restrict WordPress administrative access by IP allowlist where operationally feasible

# Example: disable the Blue Captcha plugin via WP-CLI until a patched version is available
wp plugin deactivate blue-captcha
wp plugin delete blue-captcha