CVE-2026-93900: Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstilegravityshortcode() function: the value is filtered only by eschtml() and sanitizetextfield() (neither of which touches parentheses or dots) and then emitted via escjs() in a raw JavaScript expression context outside any string literal (escjs only escapes quotes, backslashes, and newlines). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with Contributor-level access or higher and must be able to create or modify content containing the [gravity-simple-turnstile] shortcode. No victim interaction is required for the injected script to execute once a user visits the affected page.
Which sites are exposed?
Sites using Simple CAPTCHA with Cloudflare Turnstile version 1.44.3 or earlier are affected when pages or posts can contain the [gravity-simple-turnstile] shortcode. Exposure is especially relevant where Contributor or higher accounts are available to untrusted users.
What can be done if updating is not immediately possible?
Restrict Contributor-level and higher accounts to trusted users, and review content created or edited by those accounts for uses of the [gravity-simple-turnstile] shortcode with a malicious id attribute. Remove suspicious shortcode instances to prevent scripts from executing when visitors load the affected content.
How can administrators check for attempted exploitation?
Review posts and pages for the [gravity-simple-turnstile] shortcode and inspect its id attribute, particularly for values containing JavaScript-like syntax such as parentheses or dot notation. Also prioritize review of content authored by Contributor-level or other non-administrative accounts.