What is the CVSS score of CVE-2026-6495?

CVE-2026-6495 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ajax Load More are affected by CVE-2026-6495?

The Ajax Load More WordPress plugin versions before 7.8.4 contain a reflected XSS vulnerability that allows attackers to execute arbitrary JavaScript in administrator browsers through malicious…. A patch is available.

Is there a public PoC exploit available for CVE-2026-6495?

Yes, a public proof-of-concept exploit is available for CVE-2026-6495. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6495?

Within 24 hours, inventory all WordPress installations using the Ajax Load More plugin and identify systems with administrator user access. Within 7 days, update all affected installations to Ajax Load More plugin version 7.8.4 or later, prioritizing production environments and sites with sensitive data. Within 30 days, review server access logs for exploitation attempts, conduct administrator security awareness training on phishing and malicious link detection, and review browser security policies to restrict script injection vectors.

Ajax Load More CVE-2026-6495

EUVD-2026-30733 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-18 WPScan

GHSA-35c5-rhm2-6w7w

WordPress XSS Ajax Load More Unknown

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable reflected XSS needing admin click (UI:R, PR:N); scope changes into browser context (S:C) with low confidentiality/integrity impact and no genuine availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:03 vuln.today

Patch available

May 18, 2026 - 09:01 EUVD

CVE Published

May 18, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 18, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

AnalysisAI

Reflected cross-site scripting in the Ajax Load More WordPress plugin (all versions before 7.8.4) allows remote attackers to execute arbitrary JavaScript in a victim's browser by reflecting an unsanitized, unescaped request parameter back into the page. The attack targets high-privilege users such as administrators, who must be lured into clicking a crafted link; publicly available exploit code exists, though EPSS estimates exploitation probability at only 0.03% (8th percentile) and there is no public exploit identified as being used in active campaigns.

Technical ContextAI

Ajax Load More is a WordPress plugin that dynamically loads posts, comments, and other content via AJAX, commonly used to build infinite-scroll and lazy-loading interfaces. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): a user-controllable parameter is echoed back into the HTTP response without sanitization or output escaping, so an attacker-supplied payload is rendered as live markup/script in the victim's authenticated session. The affected component is identified by CPE cpe:2.3:a:unknown:ajax_load_more, and because reflection occurs in an admin-facing context the injected script executes with the privileges of the logged-in user viewing the malicious link.

RemediationAI

Vendor-released patch: upgrade the Ajax Load More plugin to version 7.8.4 or later, which sanitizes and escapes the affected parameter. Apply the update through the WordPress plugin dashboard or WP-CLI, and consult the WPScan advisory (https://wpscan.com/vulnerability/c52f28c5-547d-48ae-89dd-edcdaeadcec5/) for confirmation. If immediate patching is not possible, deploy a Web Application Firewall rule to filter reflected script payloads in requests targeting the plugin's parameters, and instruct administrators not to click untrusted links pointing at their own WordPress site; a stricter Content-Security-Policy that disallows inline script also reduces XSS impact, with the trade-off that themes or plugins relying on inline JavaScript may break. Temporarily deactivating the plugin fully removes exposure but disables any infinite-scroll/lazy-load features it powers.