When an OptinMonster campaign popup containing a WPForms form is shown, WPForms’ `bindOptinMonster()` handler calls `optinMonsterRecaptchaReset()` to re-render the reCAPTCHA/hCaptcha/Turnstile widget inside the popup. The vulnerable code read the widget’s `data-sitekey` attribute value and built a new widget element via raw HTML string concatenation (`’
‘`) which was then inserted into the DOM with jQuery’s `.prepend(htmlString)` — a markup-parsing sink. A specially crafted OptinMonster campaign supplying a malicious `data-sitekey` value (e.g. containing `”>`) could break out of the attribute context and inject arbitrary script, since the concatenated string is parsed as HTML rather than treated as literal attribute text.
This vulnerability affects the following application versions:
- WPForms 1.8.7.2
- WPForms 1.8.8.2
- WPForms 1.8.8.3
- WPForms 1.8.9.1
- WPForms 1.8.9.2
- WPForms 1.8.9.4
- WPForms 1.8.9.5
- WPForms 1.8.9.6
- WPForms 1.9.0.1
- WPForms 1.9.0.2
- WPForms 1.9.0.3
- WPForms 1.9.0.4
- WPForms 1.9.1.1
- WPForms 1.9.1.2
- WPForms 1.9.1.3
- WPForms 1.9.1.4
- WPForms 1.9.1.5
- WPForms 1.9.1.6
- WPForms 1.9.2.1
- WPForms 1.9.2.2
- WPForms 1.9.2.3
- WPForms 1.9.3.1
- WPForms 1.9.3.2
- WPForms 1.9.4.1
- WPForms 1.9.4.2
- WPForms 1.9.5
- WPForms 1.9.5.1
- WPForms 1.9.5.2
- WPForms 1.9.6
- WPForms 1.9.6.1
- WPForms 1.9.6.2
- WPForms 1.9.7.1
- WPForms 1.9.7.2
- WPForms 1.9.7.3
- WPForms 1.9.8.1
- WPForms 1.9.8.2
- WPForms 1.9.8.4
- WPForms 1.9.8.7
- WPForms 1.9.9.2
- WPForms 1.9.9.3
- WPForms 1.9.9.4
- WPForms 1.10.0.1
- WPForms 1.10.0.2
- WPForms 1.10.0.3
- WPForms 1.10.0.4
- WPForms 1.10.0.5
- WPForms 1.10.1
- WPForms 1.10.1.1
- WPForms 1.10.2
- WPForms 1.10.2.1
- WPForms 2.0.0.1