CVE-2026-16145 is a stored cross-site scripting vulnerability (CWE-79) in the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin by matthiasnordwig. The flaw exists due to improper neutralization of input during web page generation, specifically via the 'action' parameter in admin-ajax.php requests. The plugin's explicit-actions list, populated automatically for common form builders, allows unauthenticated attackers to inject arbitrary web scripts that are stored and later executed when users visit the affected pages. This vulnerability affects all versions up to and including 5.1.

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts that execute in the context of users visiting the affected pages. This can lead to partial compromise of confidentiality and integrity, such as theft of user credentials or session tokens. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling or restricting access to the vulnerable plugin or its ajax endpoints to prevent exploitation. Monitor vendor channels for updates and apply official fixes once released.