CVE-2026-16145 is a stored Cross-Site Scripting vulnerability in the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin by matthiasnordwig. The flaw exists in all versions up to 5.1 due to insufficient input sanitization and output escaping of the 'action' parameter in admin-ajax.php requests. The plugin auto-populates an explicit-actions list for common form builders at activation, and any unauthenticated request with an 'action' matching this list can write stored payloads. These payloads execute whenever a user accesses the injected page, enabling script execution in the context of the affected site.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by the plugin, leading to potential theft of user credentials, session hijacking, or other malicious actions executed in the context of users visiting the affected site. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to admin-ajax.php endpoints to trusted users only. Monitor vendor channels for official patches or updates addressing this vulnerability.