The Invisible Anti-Spam & CAPTCHA plugin for WordPress contains a stored cross-site scripting flaw caused by inadequate sanitization of the 'action' request parameter. An attacker can inject malicious scripts that are persisted in the site's pages and executed in the browsers of any user who visits the affected page, giving the attacker the ability to steal session data, deface content, or launch further attacks. This weakness is formally classified as CWE-79.

The vulnerability applies to the WordPress plugin "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms" by matthiasnordwig, affecting all releases up to and including version 5.1. WordPress sites that have installed any of these versions are potentially compromised.

The CVSS score of 7.2 marks the flaw as high severity, and the EPSS score is unavailable but the vulnerability is not yet listed in CISA's KEV catalog. The likely attack vector is an unauthenticated HTTP request to WordPress's /wp-admin/admin-ajax.php endpoint with a crafted 'action' value that matches an entry in the plugin's explicit-actions list. Because the plugin auto-populates these actions on activation and imposes no authentication gate to reach the save path, the stored payload can be written without any user credentials. Given these conditions, the risk of exploitation is significant, especially for sites that rely on this plugin for form protection.