Cross‑Site Request Forgery in the AlphaOmega Captcha & Anti‑Spam Filter plugin allows an attacker to inject arbitrary JavaScript that is stored and subsequently executed in the context of site visitors. The vulnerability originates from missing CSRF protection on certain form endpoints, letting an unauthenticated user craft requests that insert malicious code into the plugin’s storage. Once executed, the stored XSS can compromise user credentials, deface content, or facilitate further attacks. The weakness is identified as CWE‑352.

The vulnerable product is the WordPress plugin AlphaOmega Captcha & Anti‑Spam Filter from alphaomegaplugins. Versions up to and including 3.3 are affected. No specific sub‑versions are listed in the CNA data; the issue is reported as affecting all releases through 3.3.

The CVSS base score is 7.1, indicating high risk. The EPSS score is less than 1%, suggesting a low to moderate likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to send a crafted request to the vulnerable endpoint, which could be achieved via a simple link or embedded form on a third‑party site; thus it could be executed remotely against any site that has not updated the plugin.