PLUGIN SECURITY
Is Google Captcha safe?
Protect WordPress website forms from spam entries with Google reCAPTCHA.
What this plugin does
- Slug:
google-captcha - Author: bestwebsoft
- 100000+ active installs
- 78/100 rating (391 reviews on wordpress.org)
- 6764519 all-time downloads
- On WordPress.org since 2014-02-07
anti-spam securityantispamcaptchacaptharecaptcha
Maintenance status
- Latest known version: 1.87
- Last updated: 2026-04-24 5:28pm GMT
- Tested up to WordPress: 7.0.4
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
32 known CVEs on file for Google Captcha. Reported between 2015 and 2025.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-24628 | reCaptcha by BestWebSoft [google-captcha] < 1.79 | Authentication Bypass by Spoofing | Medium 5.3 | < 1.79 | 1.79 | 2025-01-03 | ✓ fixed in latest |
| CVE-2017-2171 | reCaptcha by BestWebSoft [google-captcha] < 1.28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.28 | 1.28 | 2017-05-16 | ✓ fixed in latest |
| — | reCaptcha by BestWebSoft [google-captcha] < 1.28 | — | Unknown | < 1.28 | 1.28 | 2017-04-12 | ✓ fixed in latest |
| CVE-2015-0890 | reCaptcha by BestWebSoft [google-captcha] < 1.13 | — | Unknown | < 1.13 | 1.13 | 2015-01-08 | ✓ fixed in latest |
| — | reCaptcha by BestWebSoft [google-captcha] < 1.28 | — | Unknown | < 1.28 | 1.28 | — | ✓ fixed in latest |
| CVE-2017-18487, CVE-2017-18556, CVE-2017-18558, CVE-2017-18565, CVE-2017-18490, CVE-2017-18491, CVE-2017-18492, CVE-2017-18493, CVE-2017-18494, CVE-2017-18496, CVE-2017-18500, CVE-2017-18501, CVE-2017-18502, CVE-2017-18505, CVE-2017-18517, CVE-2017-18518, CVE-2017-18527, CVE-2017-18528, CVE-2017-18529, CVE-2017-18530, CVE-2017-18532, CVE-2017-18537, CVE-2017-18542, CVE-2017-18557, CVE-2017-18566, CVE-2017-18564, CVE-2017-18562, CVE-2017-18516, CVE-2017-18590 | Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS) | — | Unknown | < 1.28 | 1.28 | — | ✓ fixed in latest |
How to fix it
Keep Google Captcha updated — 1.87 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1186) — max PHP 8.4
- Antispam Bee — 700000+ active installs — 96/100 (226) — max PHP 8.4
- Spam protection, Honeypot, Anti-Spam by CleanTalk — 200000+ active installs — 96/100 (3205) — max PHP 8.4
- hCaptcha for WP — 70000+ active installs — 92/100 (86)
- Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter — 50000+ active installs — 90/100 (369)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.