Simple CAPTCHA with Cloudflare Turnstile 1.44.3 and earlier allows stored script through a Gravity Forms shortcode (CVE-2026-93900)
Identifiers: CVE-2026-93900
- Published
- Last substantive change
- Last verified
Last verified: . Attention items are due for re-verification within 72 hours.
Summary
An authenticated user with Contributor or higher access can inject stored script through the id attribute of the [gravity-simple-turnstile] shortcode. The script runs for users who later view content containing it. This is an output-handling issue in the plugin, not a weakness in Cloudflare's Turnstile service and not a CAPTCHA bypass.
Impact
A low-privileged contributor could place script that executes in the browsers of editors, administrators or visitors viewing the affected content, which can lead to session or account misuse.
Who is affected
WordPress sites running version 1.44.3 or earlier where Contributor-level or similar accounts can submit content and the Gravity Forms integration shortcode is available. Version 1.44.4, released October 30, addresses this issue; version 1.44.5 adds separate login-form fixes that are not part of this CVE.
Products and versions
| Products and versions | Affected | Fixed |
|---|---|---|
| Simple CAPTCHA with Cloudflare Turnstile | <= 1.44.3 | 1.44.4 |
Exploitation evidence
Exploitation not established. The reviewed sources do not establish exploitation in the wild.
Actions
- After backup and compatibility checks, update to 1.44.4 or a newer patched release.
- Review who holds Contributor or higher access and remove accounts that are no longer needed.
- Review content containing shortcodes for suspicious changes.
- Test the forms you own to confirm they render and submit after the upgrade.
Unknowns
- Exploitation in the wild is not established by the reviewed sources.
- Whether content on a particular site was already modified cannot be determined from the advisory.
Sources
- Wordfence CNA / CVE Program https://cveawg.mitre.org/api/cve/CVE-2026-93900
- Simple CAPTCHA with Cloudflare Turnstile / WordPress.org https://plugins.svn.wordpress.org/simple-cloudflare-turnstile/trunk/readme.txt
Change history
- — Published: Simple CAPTCHA with Cloudflare Turnstile 1.44.3 and earlier lets Contributor-level users store script through a Gravity Forms shortcode; update to 1.44.4 or newer and review contributor content.