Invisible Anti-Spam & CAPTCHA vulnerabilities
3 known CVE vulnerabilities in Invisible Anti-Spam & CAPTCHA, translated and rated.
- CVE-2026-16146Medium
The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via JSON keys/values patterns. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.
- CVE-2026-16145High
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-16094Medium
The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via the 'key' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.