Executive brief
The Ajax Load More plugin for WordPress, which is used to add infinite scrolling to websites, contains a security flaw that allows for Reflected Cross-Site Scripting (XSS). An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to execute code in the admin's browser session. This could lead to unauthorized actions being performed on the website or the theft of sensitive session information.
Technical details
The Ajax Load More plugin for WordPress fails to properly sanitize and escape at least one input parameter before reflecting it back into the page. This vulnerability (CWE-79) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of a user's browser by enticing them to visit a specially crafted URL. While the specific parameter was not disclosed in the initial advisory, the impact is heightened if the victim is a high-privilege user such as an administrator, potentially leading to full site compromise via session hijacking or unauthorized administrative actions. The issue is fixed in version 7.8.4.
Affected products
- Conspire Media Ajax Load More < 7.8.4
Timeline
- 2026-04-27: disclosed: Publicly published by WPScan and CleanTalk researchers
- 2026-04-27: patched: Fixed version 7.8.4 released
- 2026-05-18: advisory: CVE published in NVD dataset