CVE-2025-46541 – Elrata WP-reCAPTCHA-bp Cross-site Scripting (XSS)

April 24, 2025

CVE ID : CVE-2025-46541

Published : April 24, 2025, 4:15 p.m. | 2 hours, 44 minutes ago

Description : Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in elrata_ WP-reCAPTCHA-bp allows Stored XSS. This issue affects WP-reCAPTCHA-bp: from n/a through 4.1.

Severity: 5.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-46540 – Chris Mok GNA Search Shortcode Cross-site Scripting

Next Article CVE-2025-46542 – ThemeXpert Xpert Tab Stored Cross-site Scripting

Highlights

CVE-2025-6742 – “SureForms WordPress PHP Object Injection Vulnerability”

July 9, 2025

CVE ID : CVE-2025-6742

Published : July 9, 2025, 6:15 a.m. | 22 minutes ago

Description : The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Designing Better UX For Left-Handed People

This week in AI dev tools: Gemini 2.5 Flash-Lite, GitLab Duo Agent Platform beta, and more (July 25, 2025)

Tenable updates Vulnerability Priority Rating scoring method to flag fewer vulnerabilities as critical

Google adds updated workspace templates in Firebase Studio that leverage new Agent mode

Trump’s AI plan says a lot about open source – but here’s what it leaves out

Google’s new Search mode puts classic results back on top – how to access it

These AR swim goggles I tested have all the relevant metrics (and no subscription)

Google’s new AI tool Opal turns prompts into apps, no coding required

Laravel Scoped Route Binding for Nested Resource Management

Laravel Scoped Route Binding for Nested Resource Management

Add Reactions Functionality to Your App With Laravel Reactions

saasykit/laravel-open-graphy

Sam Altman won’t trust ChatGPT with his “medical fate” unless a doctor is involved — “Maybe I’m a dinosaur here”

Sam Altman won’t trust ChatGPT with his “medical fate” unless a doctor is involved — “Maybe I’m a dinosaur here”

“It deleted our production database without permission”: Bill Gates called it — coding is too complex to replace software engineers with AI

Top 6 new features and changes coming to Windows 11 in August 2025 — from AI agents to redesigned BSOD screens

CVE-2025-46541 – Elrata WP-reCAPTCHA-bp Cross-site Scripting (XSS)

Rogue CAPTCHAs: Look out for phony verification pages spreading malware

ToolShell: An all-you-can-eat buffet for threat actors

World-Consistent Video Diffusion With Explicit 3D Modeling

Handling PostgreSQL Migrations in Node.js

CVE-2025-53305 – Lucidcrew WP Forum Server CSRF Stored XSS

CVE-2025-5231 – PHPGurukul Company Visitor Management System SQL Injection Vulnerability

CVE-2025-6742 – “SureForms WordPress PHP Object Injection Vulnerability”

CVE-2025-6462 – WordPress EZ SQL Reports Stored Cross-Site Scripting Vulnerability

CVE-2025-4141 – Netgear EX6200 Remote Buffer Overflow Vulnerability

CVE-2025-37774 – Linux Kernel Slab Object Extensions Vulnerability

CVE-2025-46541 – Elrata WP-reCAPTCHA-bp Cross-site Scripting (XSS)

Related Posts