Is Simple CAPTCHA with Cloudflare Turnstile safe?

Every recorded flaw

• Sep 10, 2026Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66674 · affects up to 1.42.1 · reported by PatchstackMedium 5.6
• Sep 10, 2026Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-66632 · affects up to 1.42.1 · reported by PatchstackMedium 6.5
• Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · fixed in 1.42.0 · reported by WPScanMedium 5.3
• Jun 15, 2026Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.CVE-2026-40799 · affects up to 1.38.0 · reported by PatchstackMedium 5.3
• Sep 27, 2023Simple Cloudflare Turnstile: Stored Cross-Site ScriptingCVE-2023-5135 · affects up to 1.23.1 · reported by WordfenceMedium 6.4

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.