CVE-2026-13157

The CVE-2026-13157 entry concerns the Demo Import WordPress plugin up to version 1.1.3, where file-type validation is bypassed during demo-content import. This allows high-privilege users (Administrator by default, including non-super-admins on multisite) to upload executable PHP files to the upl...

CVE-2026-4512 WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS

The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptchajs function. This allows administrators on multisite installations who do not have the unfilteredhtml capability to injec...

PT-2026-34643

Name of the Vulnerable Software and Affected Versions reCaptcha by WebDesignBy WordPress plugin versions prior to 2.0 Description The plugin fails to sanitize or escape the Site Key setting before it is output within a JavaScript string context through the grecaptcha js function. This allows...