EIP-2026-113593

This exploit demonstrates a stored XSS vulnerability in the BWS Captcha WordPress plugin (version <=4.1.5) due to unsanitized input in the 's' parameter of whitelist.php. The PoC shows how an attacker can craft a malicious URL or form to execute arbitrary JavaScript in the context of an authenticated admin user.