CVE-2026-57365: reCAPTCHA for Asgaros Forum XSS Flaw

CVE-2026-57365 Overview

CVE-2026-57365 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the reCAPTCHA (v2 & v3) for Asgaros Forum WordPress plugin developed by Hitesh Chandwani. The flaw stems from improper neutralization of input during web page generation [CWE-79]. All plugin versions up to and including 1.1.0 are affected. Attackers with low privileges can inject malicious script that executes in the victim's browser when a targeted user interacts with a crafted request. Successful exploitation impacts confidentiality, integrity, and availability of the victim's session because the vulnerability crosses a security scope boundary.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session hijacking, forum defacement, and forced actions in the context of the impacted user.

Affected Products

• Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Forum plugin (recaptcha-for-asgaros-forum)
• All versions from n/a through 1.1.0
• WordPress installations running the affected plugin alongside Asgaros Forum

Discovery Timeline

• 2026-07-13 - CVE-2026-57365 published to NVD
• 2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57365

Vulnerability Analysis

The vulnerability is a DOM-Based Cross-Site Scripting flaw classified under [CWE-79]. The plugin fails to properly neutralize input before it is written to the Document Object Model on the client side. When a crafted value is processed by the plugin's JavaScript, the browser interprets attacker-supplied content as executable script rather than data.

Exploitation requires an authenticated user with low privileges to submit input, and a separate user must interact with the resulting content for the payload to trigger. Because the vulnerability changes the security scope, code executes in the context of the victim's authenticated session. Impacts include stealing session cookies, performing actions on behalf of the victim, and manipulating forum content rendered by the plugin.

An EPSS score of 0.161% indicates a low probability of exploitation in the near term, though DOM-based XSS in WordPress ecosystems remains a common attack surface.

Root Cause

The root cause is the absence of proper output encoding or sanitization when user-controllable data is written into the DOM by the plugin's client-side code. Values that should be treated as inert text are instead assigned into contexts that permit script execution, such as innerHTML sinks or unsafe attribute writes.

Attack Vector

The attack vector is network-based over HTTP(S). An authenticated attacker submits crafted input through a plugin-controlled field. When a victim loads the page containing that data, the plugin's JavaScript processes the input and injects the payload into the DOM. User interaction is required, and the executing script operates in the victim's browser context on the WordPress site's origin.

No verified public exploit code is available. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-57365

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes (for example onerror, onload) appearing in forum posts, profile fields, or reCAPTCHA-related plugin output.
• Outbound browser requests from authenticated sessions to attacker-controlled domains carrying session cookies or CSRF tokens.
• WordPress administrative actions initiated from unusual client contexts shortly after users visited affected forum pages.

Detection Strategies

• Inspect stored forum entries and plugin option values for HTML metacharacters and script-like payloads written by low-privileged accounts.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations sourced from plugin pages.
• Review web server logs for repeated POST requests to Asgaros Forum endpoints followed by unusual outbound traffic from visitors.

Monitoring Recommendations

• Enable WordPress audit logging for content changes made by subscriber and contributor roles.
• Monitor browser CSP violation reports for the WordPress origin and alert on inline script violations.
• Track plugin file integrity to detect unauthorized changes to recaptcha-for-asgaros-forum assets.

How to Mitigate CVE-2026-57365

Immediate Actions Required

• Identify all WordPress sites running recaptcha-for-asgaros-forum version 1.1.0 or earlier and prioritize remediation.
• Restrict forum posting and account creation to trusted users until a fixed version is deployed.
• Rotate WordPress administrator and moderator sessions if suspicious payloads have been observed.

Patch Information

No fixed version was listed in the enriched CVE data at publication. Consult the Patchstack Vulnerability Report and the plugin's official channel for updates beyond version 1.1.0.

Workarounds

• Deactivate and remove the recaptcha-for-asgaros-forum plugin until a patched release is available and use an alternative CAPTCHA integration.
• Deploy a Web Application Firewall (WAF) rule to block HTML metacharacters and script keywords in requests to Asgaros Forum submission endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts on WordPress pages that render forum content.

# Configuration example: strict CSP header via Apache to mitigate inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"