Description

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated admin-ajax.php request whose action value matches an entry in the plugin's explicit-actions list, which is auto-populated for common form builders at activation and requires no authentication gate to reach the save path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-15T04:18:10.233Z",
  "pubdate": "2026-08-15T04:18:10.233Z",
  "executiveSummary": "The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS).\nThe vulnerability affects all versions up to, and including, 5.1.\nIt allows unauthenticated attackers to inject arbitrary web scripts into pages via the 'action' parameter.\nInjected scripts execute whenever an unsuspecting user accesses an injected page.\nThe security flaw stems from insufficient input sanitization and output escaping within the plugin's request handling mechanism.\nAttackers can leverage this vulnerability without authentication by exploiting the admin-ajax.php endpoint.\nSuccessful exploitation requires the action value to match an entry in the plugin's explicit-actions list, which is auto-populated for common form builders upon activation.\nThe risk implications include potential session hijacking, administrative privilege escalation, site defacement, and redirection to malicious external domains.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate input sanitization and output escaping applied to the 'action' parameter processed by the plugin.\nThe vulnerable component is exposed via the WordPress admin-ajax.php endpoint, which routes asynchronous requests to backend handlers.\nThe affected versions include all releases of the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin up to, and including, version 5.1.\nExploitation does not require authentication or specific privileges, making it accessible to remote, unauthenticated attackers over the network.\nThe attack flow begins when an unauthenticated attacker crafts an HTTP request targeting the admin-ajax.php file.\nThe attacker supplies a malicious payload containing arbitrary JavaScript within the 'action' parameter.\nThe request reaches the plugin's save path because the target action value matches an entry in the plugin's explicit-actions list.\nThis explicit-actions list is auto-populated for common form builders during the plugin's activation process and lacks an explicit authentication gate to protect the save path.\nOnce the malicious payload is accepted, it is persistently written to the database without proper sanitization.\nPost-exploitation impact occurs when any user, including high-privileged administrators, accesses a web page rendering the stored payload.\nThe browser executes the injected script within the context of the victim's session, leading to potential session compromise, unauthorized actions, and further exploitation of the WordPress environment."
}