Contact Form 7 reCAPTCHA WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Contact Form 7 reCAPTCHA WordPress plugin, affecting versions through 1.2.0. The issue arises because the plugin fails to properly escape the $_SERVER['REQUEST_URI'] parameter before including it in an attribute, potentially leading to XSS attacks in older web browsers.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the WordPress admin panel and access the Contact Form 7 reCAPTCHA settings page. Include a script tag in the 'cows' parameter of the request URL. The injected script will be executed, demonstrating the cross-site scripting vulnerability.