CVE-2026-16145 matthiasnordwig CVE debrief

Who should care

Administrators of WordPress installations using the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin, security teams monitoring for potential XSS attacks, and users of the affected plugin versions should prioritize updating to a patched version to prevent potential XSS attacks. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1. This is due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects all versions of the plugin up to 5.1, and the stored payload can be written by any unauthenticated admin-ajax.php request whose action value matches an entry in the plugin's explicit-actions list.

Defensive priority

Administrators of WordPress installations using the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin should prioritize updating to a patched version to prevent potential XSS attacks.

Recommended defensive actions

• Update to a patched version of the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin
• Monitor for suspicious admin-ajax.php requests
• Implement additional security measures to detect and prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates that the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter. The vulnerability affects all versions up to, and including, 5.1. The stored payload can be written by any unauthenticated admin-ajax.php request whose action value matches an entry in the plugin's explicit-actions list.

Official resources