MediumCVSS 5.3
EPSS 0.26%
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
Product
WebFactory Advanced Google reCAPTCHA vulnerabilities
6 published CVES affecting WebFactory Advanced Google reCAPTCHA, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 0
- High
- 2
- Medium
- 4
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest WebFactory Advanced Google reCAPTCHA CVEs
Newest publication first
-
-
HighCVSS 8.8 EPSS 0.61%
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the l...
-
HighCVSS 8.8 EPSS 0.54%
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a no...
-
MediumCVSS 5.3 EPSS 0.43%
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to generic SQL Injection via the ‘sSearch’ parameter in all versions up to, and including, 1.29 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
-
MediumCVSS 5.3 EPSS 0.34%
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
-
MediumCVSS 5.3 EPSS 0.35%
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions up to, and including, 1.25. This is due to the plugin not utilizing a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers to un...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.