CVE-2026-85116

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions 1.2.2 before 1.42.3) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that the plugin's shortcode parser runs over the entire rendered Contact Form 7 form, including values a visitor submitte...

CVE-2026-85116 Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85117

Contact Form 7 Captcha WordPress plugin versions 0.1.7 through 0.1.8 are affected by an unauthenticated arbitrary shortcode execution vulnerability. The root cause is that the plugin runs the shortcode parser over the entire rendered Contact Form 7 form, including values submitted by a visitor du...