EUVD-2026-43002
GHSA-wjqm-g2vx-78pg
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Admin-level auth (PR:H) and non-default deployment conditions (AC:H) are required; S:C and C:L/I:L reflect cross-user XSS with limited per-victim impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in the Ajax Load More WordPress plugin (versions through 7.0.1) allows authenticated administrators to inject persistent malicious scripts into pages served to other users. The vulnerability stems from insufficient input sanitization and output escaping in admin-facing settings fields. Exploitation is constrained to WordPress multisite environments or sites with unfiltered_html disabled, and no public exploit or KEV listing exists at time of analysis, keeping real-world risk moderate despite the network-accessible vector.
Technical ContextAI
The affected product is the 'Ajax Load More' plugin (WordPress slug: ajax-load-more), a widely used infinite scroll and AJAX pagination solution for WordPress. The root cause is CWE-692 (Inadequate Encoding of Output), a subclass of improper output escaping: admin-controlled input stored in WordPress option tables is later rendered into page HTML without sanitization or escaping, allowing arbitrary script injection. The vulnerability lives in admin settings fields - input that WordPress normally restricts via the unfiltered_html capability. The scope-change in the CVSS vector (S:C) reflects that the injected payload executes in victim browsers across a different security principal than the attacker's session.
RemediationAI
Update the Ajax Load More plugin to the version released after 7.0.1 - the upstream patch is committed at WordPress SVN changeset 3033302, but the exact tagged release version should be confirmed via the plugin's WordPress.org page or the Wordfence advisory before deploying. Site administrators should update through the WordPress dashboard (Plugins → Available Updates) or via WP-CLI ('wp plugin update ajax-load-more'). As a compensating control where immediate patching is not possible, restricting the administrator role to trusted accounts only reduces the attacker pool; in multisite environments, consider whether super-admin access can be further segmented. Note that this vulnerability only manifests in multisite WordPress installations or where the unfiltered_html capability has been explicitly revoked - single-site installations with default capability settings are not affected and do not require emergency remediation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today