title: Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting
description: The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Contact Form 7 Captcha
vendor: Unknown
versions:
lessThan: 0.1.2, status: affected, version: 0.1.2, versionType: custom
}