Known vulnerabilities in reCaptcha by BestWebSoft

Protect WordPress website forms from spam entries with Google reCAPTCHA.

3Reported vulnerabilities

6.1Highest CVSS score

1.87Latest version

100,000+Active installs

What to do now

Update reCaptcha by BestWebSoft to 1.79 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: April 24, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-169f2767-da20-4199-9997-438a62f6aee4	Medium 6.1	—	Before 1.28	`1.28`	April 12, 2017
CVE-2015-0890	Medium 5	2.4%	1.12 and earlier	`1.13`	March 3, 2015
CVE-2025-24628	Medium 5.3	0.3%	1.78 and earlier	`1.79`	January 3, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.