Captcha

Captcha has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2017; all 3 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 9.6 out of 10. Severity breakdown: 1 critical and 0 high. 2017 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Guessable CAPTCHA, Hidden Functionality.

Every one of the 3 issues recorded for Captcha has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Captcha vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.6

Captcha 4.3.6 - 4.4.4 - Plugin Backdoor

Read the full analysis

Vulnerability Records

3 records


2017-12-19 00:00	Captcha 4.3.6 - 4.4.4 - Plugin Backdoor Captcha 4.3.6 – 4.4.4	`N/A`	9.6 Critical	Matt Barry	Yes
2017-04-12 00:00	Captcha < 4.3.0 - Reflected Cross-Site Scripting Captcha < 4.3.0	`N/A`	6.1 Medium	Neven Birusk	Yes
2014-08-01 00:00	Captcha <= 3.8.1 - Captcha Bypass Captcha <= 3.8.1	`N/A`	5.3 Medium	cervoise	Yes

Showing 1–3 of 3 reports