CVE-2025-8080 Overview
CVE-2025-8080 is a Stored Cross-Site Scripting (XSS) vulnerability in the Alobaidi Captcha plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.3. It stems from insufficient input sanitization and output escaping in the plugin settings. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users visit affected pages. The issue is scoped to WordPress multi-site installations and single-site environments where the unfiltered_html capability has been disabled. The vulnerability is classified under CWE-79.
Critical Impact
Authenticated administrators on multi-site or restricted WordPress installations can persist JavaScript payloads through the plugin settings, resulting in script execution in the browsers of other users who access the injected pages.
Affected Products
- Alobaidi Captcha plugin for WordPress, all versions through 1.0.3
- WordPress multi-site installations running the plugin
- WordPress single-site installations with unfiltered_html disabled
Discovery Timeline
- 2025-08-15 - CVE-2025-8080 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8080
Vulnerability Analysis
The Alobaidi Captcha plugin exposes settings fields that accept administrator-supplied values and later render them into the login form output. The plugin does not sanitize input on save and does not escape output on render. An administrator who submits a payload containing HTML or JavaScript stores the raw string in the plugin configuration. When WordPress renders the affected pages, the browser parses the stored payload as markup, executing any embedded scripts.
The issue only reaches users who cannot otherwise inject HTML themselves. On multi-site installations, unfiltered_html is disabled for administrators by default, so this pathway grants a capability the platform explicitly withholds. The same applies to single-site instances where unfiltered_html has been revoked by policy. On typical single-site installations where administrators retain unfiltered_html, the attack does not add meaningful capability.
The relevant code paths are documented in the plugin source at lines 26, 41, and 63 of login-form.php. Wordfence published a full vulnerability analysis describing the affected settings and payload flow.
Root Cause
The plugin trusts administrator-provided settings values without applying WordPress sanitization functions such as sanitize_text_field() on save, and without escaping via esc_html() or esc_attr() on output. Combined with the multi-site trust boundary, this allows stored payloads to bypass the unfiltered_html restriction.
Attack Vector
An attacker who holds administrator credentials on a targeted site submits crafted values through the plugin settings page. The payload persists in the WordPress options table. Subsequent visitors, including users with higher network-wide privileges on multi-site installations, load the injected script in their session context. See the Wordfence advisory for the technical breakdown.
Detection Methods for CVE-2025-8080
Indicators of Compromise
- Plugin option rows in wp_options containing <script>, onerror=, javascript:, or other HTML sink patterns tied to Alobaidi Captcha settings keys.
- Rendered login form pages that return unexpected inline scripts or event-handler attributes sourced from plugin settings.
- Administrator activity logs showing settings updates to the Alobaidi Captcha plugin from unfamiliar IP addresses or sessions.
Detection Strategies
- Audit the wp_options table for Alobaidi Captcha configuration keys and validate that stored values contain no HTML or JavaScript tokens.
- Deploy a Web Application Firewall (WAF) rule that inspects POST requests to wp-admin/options.php or plugin-specific settings endpoints for script markup in Alobaidi Captcha parameters.
- Compare live plugin files against the upstream 1.0.3 distribution to identify any tampering or backdoored settings handlers.
Monitoring Recommendations
- Alert on administrator role changes and privilege elevation events on multi-site networks running the plugin.
- Log and review outbound requests initiated from browsers rendering the WordPress login page, which can surface exfiltration by injected scripts.
- Track plugin version inventory across WordPress fleets and flag any host still running Alobaidi Captcha at 1.0.3 or earlier.
How to Mitigate CVE-2025-8080
Immediate Actions Required
- Deactivate the Alobaidi Captcha plugin on multi-site installations and on any single-site installation with unfiltered_html disabled until a patched release is available.
- Rotate administrator credentials and enforce multi-factor authentication for all users with settings-modification rights.
- Inspect and clean any stored plugin settings that contain HTML or script content.
Patch Information
At the time of the NVD entry, no fixed version beyond 1.0.3 has been published for the Alobaidi Captcha plugin. Track the WordPress plugin repository and the Wordfence advisory for an updated release.
Workarounds
- Remove the plugin from multi-site networks and replace it with a maintained CAPTCHA plugin that applies proper sanitization and escaping.
- Restrict access to the plugin settings page via server-side controls or role-based policies until a fix ships.
- Apply a WAF rule that blocks HTML tags and JavaScript event handlers in POST bodies targeting the plugin's option keys.
# Example: locate the plugin across a WordPress fleet and disable it via WP-CLI
wp plugin list --format=csv | grep alobaidi-captcha
wp plugin deactivate alobaidi-captcha --network
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
