CVE-2025-60177: Recaptcha WP Plugin Stored XSS Vulnerability

CVE-2025-60177 Overview

CVE-2025-60177 is a stored Cross-Site Scripting (XSS) vulnerability in the rozx Recaptcha – wp WordPress plugin. The flaw affects all versions up to and including 0.2.6. It stems from improper neutralization of user-controlled input during web page generation, classified as [CWE-79].

An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected pages. Successful exploitation requires user interaction and can impact users across security scopes, which is reflected in the scope-changed CVSS metric.

Critical Impact
Stored JavaScript payloads execute in victim browsers, enabling session theft, admin account takeover, and unauthorized actions within the WordPress administrative interface.

Affected Products

rozx Recaptcha – wp plugin for WordPress
All versions from initial release through 0.2.6
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-09-26 - CVE-2025-60177 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60177

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Recaptcha – wp plugin. User-supplied input is written to persistent storage and later rendered in a web page without sufficient output encoding or input sanitization. Because the payload is stored, it executes whenever a victim loads the affected page.

The issue requires an attacker with high privileges to submit the malicious payload, and a victim must interact with the rendered content for execution to occur. The scope-changed nature of the flaw means injected scripts can affect resources beyond the vulnerable component, including administrative sessions.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to apply WordPress sanitization primitives such as sanitize_text_field() on input, and does not apply context-appropriate escaping functions such as esc_html(), esc_attr(), or esc_js() on output. As a result, HTML and JavaScript control characters survive into the rendered DOM.

Attack Vector

An authenticated attacker with administrative or equivalent high-privilege access submits a payload containing HTML or JavaScript through a vulnerable plugin input field. The payload is persisted in the WordPress database. When another user, including a different administrator, navigates to a page that renders the stored value, the browser parses and executes the attacker-controlled script.

The vulnerability manifests in the plugin's input handling and output rendering paths. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-60177

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in WordPress wp_options or plugin-specific database tables
Outbound requests from administrator browsers to unknown domains shortly after loading WordPress admin pages
New or modified administrator accounts created without a corresponding audit trail
Session cookies for wp-admin observed in unexpected geographic locations or user agents

Detection Strategies

Query the WordPress database for plugin settings containing HTML tag characters or JavaScript keywords such as <script, onerror=, or document.cookie
Deploy a web application firewall rule to flag POST requests to plugin configuration endpoints containing HTML markup
Correlate high-privilege user logins with subsequent unauthorized privilege changes or plugin modifications

Monitoring Recommendations

Enable WordPress audit logging to record all plugin configuration changes with the acting user and payload contents
Monitor Content Security Policy (CSP) violation reports for inline script executions on admin pages
Alert on modifications to wp_users and wp_usermeta tables occurring outside of expected administrative workflows

How to Mitigate CVE-2025-60177

Immediate Actions Required

Deactivate the Recaptcha – wp plugin until a patched version is confirmed available and installed
Rotate all administrator passwords and invalidate active WordPress sessions using wp_logout() for all users
Review administrator accounts and remove any unauthorized users created during the exposure window
Audit stored plugin settings for injected HTML or JavaScript payloads and remove malicious content

Patch Information

The vendor advisory does not list a fixed version at the time of publication. The vulnerability affects all releases through 0.2.6. Consult the Patchstack Vulnerability Report for the latest patch status and update guidance.

Workarounds

Remove or deactivate the plugin and substitute an actively maintained CAPTCHA plugin
Restrict access to WordPress administrative accounts using multi-factor authentication and principle of least privilege
Deploy a WAF ruleset that blocks HTML and JavaScript characters in requests targeting plugin configuration endpoints
Implement a strict Content Security Policy that disallows inline scripts on WordPress admin pages

bash

# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate recaptcha-wp
wp plugin delete recaptcha-wp

# Force logout of all active sessions
wp user session destroy --all