Stored Cross-Site Scripting in Invisible Anti-Spam & CAPTCHA Plugin for WordPress

The Invisible Anti-Spam & CAPTCHA plugin for WordPress, in versions 5.1 and earlier, contains a critical Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization and escaping of the 'action' parameter when processed by the plugin's 'admin-ajax.php' handler. An attacker can submit unauthenticated HTTP requests to this endpoint, triggering the injection of arbitrary JavaScript into the application's database. Because the plugin auto-populates common form builder actions at activation, these entry points are publicly accessible without authentication. Successful exploitation allows for the execution of malicious scripts whenever an administrator or user views the affected page, potentially leading to session hijacking or unauthorized administrative actions.

Impact

The vulnerability affects all sites utilizing the Invisible Anti-Spam & CAPTCHA plugin up to version 5.1. Successful exploitation enables unauthenticated attackers to execute arbitrary code in the context of the victim's browser session. In a WordPress environment, this frequently leads to full administrative account takeover, site defacement, or the injection of persistent malicious redirects and malware distribution scripts.

Recommendation

• Update the Invisible Anti-Spam & CAPTCHA plugin to the latest available version beyond 5.1 immediately.
• Review web server logs for HTTP POST requests to admin-ajax.php containing suspicious characters (e.g., <script>, alert(), or event handlers) within the 'action' parameter.
• Implement a Web Application Firewall (WAF) rule to validate input against the 'action' parameter on WordPress sites to block non-alphanumeric character injections.