Continue our talk about last participant of the project - Captcha!. It is captcha plugin for WordPress. Vulnerable version is Captcha! 2.5d (and previous versions).
This captcha in addition to Cross-Site Request Forgery and Insufficient Anti-automation is also vulnerable for XSS (like Math Comment Spam Protection). These Cross-Site Scripting holes I found 10.11.2007.
There are four XSS holes and they are persistent XSS. Holes are at plugin options page (http://site/wp-admin/options-general.php? page=captcha\captcha.php) in parameters captcha_ttffolder, captcha_numchars, captcha_ttfrange, captcha_secret. For attacking you need to make POST request to plugin options script.
These exploits for educational purposes only. Don’t use these holes and exploits for malicious purposes.
You need to setup exploits to test them (set site’s URL and others data).
Moral: always make more secure captchas and without XSS holes.