Matthiasnordwig
Monthly
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.