Invisible Anti-Spam & CAPTCHA — ReCAPTCHA Alternative for All Forms - CraftedSignal Threat Feed

Invisible Anti-Spam & CAPTCHA — ReCAPTCHA Alternative for All Forms - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/invisible-anti-spam--captcha--recaptcha-alternative-for-all-forms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 15 Aug 2026 06:16:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in Invisible Anti-Spam & CAPTCHA Plugin for WordPresshttps://feed.craftedsignal.io/briefs/2026-08-wordpress-xss/Sat, 15 Aug 2026 06:16:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-wordpress-xss/An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Invisible Anti-Spam & CAPTCHA plugin (<= 5.1) allows attackers to inject malicious scripts via the action parameter in admin-ajax.php.The Invisible Anti-Spam & CAPTCHA plugin for WordPress, in versions 5.1 and earlier, contains a critical Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization and escaping of the 'action' parameter when processed by the plugin's 'admin-ajax.php' handler. An attacker can submit unauthenticated HTTP requests to this endpoint, triggering the injection of arbitrary JavaScript into the application's database. Because the plugin auto-populates common form builder actions at activation, these entry points are publicly accessible without authentication. Successful exploitation allows for the execution of malicious scripts whenever an administrator or user views the affected page, potentially leading to session hijacking or unauthorized administrative actions.

Impact

The vulnerability affects all sites utilizing the Invisible Anti-Spam & CAPTCHA plugin up to version 5.1. Successful exploitation enables unauthenticated attackers to execute arbitrary code in the context of the victim's browser session. In a WordPress environment, this frequently leads to full administrative account takeover, site defacement, or the injection of persistent malicious redirects and malware distribution scripts.

Recommendation

Update the Invisible Anti-Spam & CAPTCHA plugin to the latest available version beyond 5.1 immediately.
Review web server logs for HTTP POST requests to admin-ajax.php containing suspicious characters (e.g., <script>, alert(), or event handlers) within the 'action' parameter.
Implement a Web Application Firewall (WAF) rule to validate input against the 'action' parameter on WordPress sites to block non-alphanumeric character injections.

]]>highadvisory