Executive brief
The Endless Scroll plugin for WordPress, which provides continuous page loading functionality, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. When other users or administrators visit these affected pages, the scripts will execute automatically in their browsers. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on shortcode attributes. This vulnerability exists in all versions up to and including 1.0.0. An authenticated attacker with contributor-level permissions or higher can exploit this by embedding malicious JavaScript within a shortcode. Because the plugin fails to properly neutralize this input before it is stored and subsequently rendered, the script will execute in the context of any user's browser who views the compromised page. The attack vector is network-based and requires low administrative privileges, but no user interaction from the victim beyond visiting the page.
Affected products
- WordPress Endless Scroll Up to, and including, 1.0.0
Timeline
- 2026-05-27: disclosed: Initial publication of the CVE record.
- 2026-05-27: advisory: Wordfence published the vulnerability details.