hcaptcha vulnerabilities

Products

• hCaptcha for WP 3

Latest hcaptcha CVEs

Newest publication first

1. CVE-2026-103347 WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability

   Published 2026-10-01

   Medium·CVSS 5.3

   Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.

2. CVE-2026-25315 WordPress hCaptcha for WP plugin <= 4.21.1 - Broken Access Control vulnerability

   Published 2026-02-19

   Medium·CVSS 5.3

   Missing Authorization vulnerability in hcaptcha hCaptcha for WP hcaptcha-for-forms-and-more allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects hCaptcha for WP: from n/a through <= 4.21.1.

3. CVE-2024-4014 hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode

   Published 2024-04-20

   Medium·CVSS 6.4

   The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.