BulletProof Security < 6.1 - Admin+ Stored Cross-Site Scripting

Proof of Concept

With the plugin setup completed, as administrator, put the payload below in the BPS Security > JTC Lite > "Login Form: CAPTCHA Error message" field and tick the "Enable|Disable JTC For These Forms: " > "Login Form" as well
 
<style>@keyframes x{}</style><article style="animation-name:x" onanimationend="alert(/Stored XSS/)"></article>  

The XSS will be executed on the login page following an incorrect CAPTCHA entry.