CVE-2026-93900

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the gravity-simple-turnstile shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the...

CVE-2026-93900 Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the gravity-simple-turnstile shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the...

CVE-2026-93900

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.44.3 . The flaw exists in the cfturnstile_gravity_shortcode() function, where the id attribute of the [gravity-simple-turnstile] shortcode undergo...

EUVD-2026-116805

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the gravity-simple-turnstile shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the...