What is the CVSS score of EUVD-2026-58864?

EUVD-2026-58864 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Invisible Anti-Spam CAPTCHA are affected by EUVD-2026-58864?

WordPress sites running Invisible Anti-Spam & CAPTCHA plugin version 5.1 or earlier are exposed to persistent malicious script injection affecting every site visitor.

How to fix or mitigate EUVD-2026-58864?

Within 24 hours, audit all WordPress instances for Invisible Anti-Spam & CAPTCHA version 5.1 or earlier and disable or remove the plugin to close the attack vector immediately. Within 7 days, deploy an alternative anti-spam solution (such as reCAPTCHA v3 or Cloudflare Turnstile) and conduct forensic analysis of site logs and page content to identify any previously injected malicious scripts. Within 30 days, implement mandatory security review for all WordPress plugins before deployment, enable automatic security updates, and establish monitoring of the WordPress plugin repository for a patched version release.

Invisible Anti-Spam CAPTCHA EUVD-2026-58864

| CVE-2026-16145 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-15 Wordfence

GHSA-9x6r-qjxj-jj37

PHP WordPress XSS Wordpress Plugin Invisible Anti Spam Captcha Recaptcha Alternative For All Forms Matthiasnordwig

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Stored XSS requires a victim to browse to the injected page for execution to complete, warranting UI:R per FIRST scoring guidance - the provided UI:N reflects only the unauthenticated write phase; all other metrics align with the unauthenticated network write and changed-scope browser execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 04:02 vuln.today

CVE Published

Aug 15, 2026 - 03:25 cve.org

HIGH 7.2

DescriptionCVE.org

The Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated admin-ajax.php request whose action value matches an entry in the plugin's explicit-actions list, which is auto-populated for common form builders at activation and requires no authentication gate to reach the save path.

AnalysisAI

Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.

Technical ContextAI

The vulnerability resides in the PHP plugin identified by CPE cpe:2.3:a:matthiasnordwig:invisible_anti-spam_&_captcha_-_recaptcha_alternative_for_all_forms, distributed under the WordPress.org slug gdpr-compliant-recaptcha-for-all-forms. The plugin registers WordPress AJAX action handlers accessible via the unauthenticated admin-ajax.php endpoint. At activation, it builds an explicit-actions list pre-populated with action slugs for common form builders such as Contact Form 7 and Gravity Forms. Per referenced source code in class-stamp.php (lines 136 and 771) and class-message-page.php (line 621) from the version 5.0 tag, the code that accepts and persists the 'action' parameter value performs insufficient input sanitization before storage and insufficient output escaping on render, satisfying CWE-79 (Improper Neutralization of Input During Web Generation). The save path is guarded only by action-name matching - not by WordPress nonce validation or capability checks - enabling any unauthenticated HTTP client to trigger the write path.

RemediationAI

Upstream fix available (WordPress plugin repository changeset 3633500); the exact released patched version is not independently confirmed from available data - update the plugin to the latest available version immediately via the WordPress admin dashboard (Plugins → Updates) or from https://wordpress.org/plugins/gdpr-compliant-recaptcha-for-all-forms/, and verify the installed version exceeds 5.1 post-update. If an immediate update is not feasible, a compensating control is to restrict unauthenticated POST requests to wp-admin/admin-ajax.php at the web server or WAF layer for action values not explicitly required by other plugins; this reduces the attack surface but risks breaking legitimate AJAX functionality for co-installed plugins and should be validated in a staging environment before production deployment. As a last resort, temporarily deactivating the plugin entirely eliminates the vulnerability until a verified patched version can be applied, though this removes anti-spam protection for all associated forms.