Executive brief
The Invisible Anti-Spam & CAPTCHA plugin for WordPress contains a security flaw that allows attackers to inject malicious scripts into website pages without needing to log in. When a site visitor views an affected page, the malicious code executes in their browser, potentially stealing login credentials, site data, or redirecting users to malicious websites. This vulnerability affects all versions up to 5.1 and poses a significant risk to any WordPress site using this plugin.
Technical details
The plugin is vulnerable to Stored Cross-Site Scripting (XSS) in the 'action' parameter due to insufficient input sanitization and output escaping. The vulnerability exists in the admin-ajax.php request handler, where unauthenticated requests can inject payloads if their action value matches an entry in the plugin's explicit-actions list. This list is auto-populated at plugin activation for common form builders and requires no authentication to reach the save path. An attacker can craft a malicious request that stores JavaScript code, which then executes whenever any user accesses the affected page. Patches are expected as the vulnerability affects versions up to and including 5.1.
Affected products
- Wordpress Plugin Developer Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms up to and including 5.1
Timeline
- 2026-08-15: disclosed