The Contact Form 7 reCAPTCHA plugin for WordPress has a security weakness, identified as a Reflected Cross-Site Scripting (XSS) vulnerability. This means a hacker could trick your website into running harmful code in a visitor’s web browser, especially older ones. This usually happens when the plugin doesn’t properly clean up or “escape” certain information it gets from the web address, allowing malicious scripts to be injected.
CVE Details
This specific issue is tracked as CVE-2025-8280. It was officially published on September 12, 2025, and is currently classified as “Analyzed.” The vulnerability carries a “Medium” severity rating with a CVSS score of 5.8.
Affected Products
The vulnerability affects the **Contact Form 7 reCAPTCHA WordPress plugin** up to and including version 1.2.0. If you are using this plugin on your WordPress website, especially version 1.2.0 or older, your site might be at risk.
Current Status
As of the latest analysis, this vulnerability is categorized as “Analyzed.” This means security experts have reviewed the issue and understand its nature.
Severity Level
The vulnerability is rated as “Medium” severity, with a CVSS score of 5.8. While not critical, a successful XSS attack can lead to various problems, including stealing user session cookies, defacing websites, or redirecting users to malicious sites. The fact that it primarily affects “old web browsers” lowers the practical impact somewhat but doesn’t eliminate the risk entirely, as some users might still operate older browsers.
Possible Solutions
According to the WPScan vulnerability database, there is **no known fix** or official patch available for this vulnerability at this time. This presents a challenge for affected users.
Given the absence of a direct patch, here are some actions you can consider:
* **Update Browsers**: Ensure all your website visitors, and especially your administrators, are using modern, up-to-date web browsers that are less susceptible to older XSS attack vectors.
* **Web Application Firewall (WAF)**: Implement a robust WAF to detect and block malicious requests that attempt to exploit XSS vulnerabilities. This acts as a protective layer in front of your website.
* **Plugin Alternatives**: If the reCAPTCHA functionality is critical, consider switching to an alternative plugin that is regularly updated and has a strong security track record, or explore other reCAPTCHA integration methods.
* **Remove/Disable**: If the reCAPTCHA feature provided by this specific plugin is not essential for your website, consider disabling or completely removing the plugin until a secure update becomes available.
* **Monitor Your Site**: Regularly scan your WordPress installation for vulnerabilities and monitor for any suspicious activity.
Always back up your website before making any significant changes or removing plugins.
References
https://wpscan.com/vulnerability/f8370026-6293-4814-961f-c254ee8e844d/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8280
