A Stored Cross-Site Scripting vulnerability in the Invisible Anti-Spam & CAPTCHA plugin for WordPress allows unauthenticated attackers to execute arbitrary scripts.

This vulnerability (CWE-79) arises from improper neutralization of input within the 'action' parameter. The attack vector is remote and unauthenticated, allowing any visitor to trigger the vulnerability.

Successful exploitation can result in the execution of malicious scripts in the browsers of users or administrators. This can lead to session theft, unauthorized actions, or defacement of the affected website. The CVSS score of 7.2 highlights the significant risk posed to both the platform's security and its users.

Immediate Action: Update the Invisible Anti-Spam & CAPTCHA plugin to version 5.1.1 or later to address the vulnerability.

Proactive Monitoring: Regularly audit plugin logs and monitor for unexpected changes to site content or unusual browser-side behavior.

Compensating Controls: Implement a Web Application Firewall (WAF) to block malicious inputs targeting the 'action' parameter or similar vectors.

Public Exploit Available: Unknown.

Due to the severity of stored XSS, all users of this plugin should apply the update to version 5.1.1 immediately. Proactive patching is essential to maintain the security posture of the WordPress installation.