CVE-2026-16145

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the action parameter in the admin-ajax.php endpoint. An attacker can inject arbitrary web scripts by sending a request where the action value matches an entry in the plugin's explicit-actions list, which is auto-populated for common form builders during activation and lacks authentication requirements to reach the save path. These scripts execute whenever a user accesses the affected page.

Recommendations Update to a version newer than 5.1.