What is the CVSS score of CVE-2026-8141?

CVE-2026-8141 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Ajax Load More Filters are affected by CVE-2026-8141?

The Ajax Load More - Filters WordPress plugin (versions through 3.4.1) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject persistent malicious code…

How to fix or mitigate CVE-2026-8141?

Within 24 hours: Inventory all WordPress installations using Ajax Load More - Filters plugin and disable it immediately. Within 7 days: If disabling is not feasible, deploy Web Application Firewall (WAF) rules to block malicious payloads in the 'taxonomy_include_children' parameter and implement Content Security Policy (CSP) headers; enable security event logging to detect exploitation attempts. Within 30 days: Monitor Wordfence and official plugin repository for patch release; evaluate alternative filtering plugins and plan migration strategy.

Ajax Load More Filters CVE-2026-8141

EUVD-2026-40274 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 Wordfence

GHSA-29c9-xrhx-266f

WordPress XSS Ajax Load More Filters

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-reachable unauthenticated stored XSS (AV:N/AC:L/PR:N) with changed scope since script runs in other users' sessions; Low C/I and no availability impact match browser-context compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 10:20 vuln.today

CVE Published

Jun 30, 2026 - 09:31 cve.org

HIGH 7.2

DescriptionCVE.org

The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - 2 Critical, 5 High, 2 With POC Jul 01, 2026

AnalysisAI

Stored cross-site scripting in the Ajax Load More - Filters WordPress plugin (all versions through 3.4.1) lets unauthenticated attackers persist arbitrary JavaScript via the 'taxonomy_include_children' parameter, which then executes in the browser of any user who loads an affected page. Wordfence rates it CVSS 7.2 with a changed scope, reflecting that injected script runs in the context of other site visitors and administrators. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) in a WordPress add-on. Ajax Load More - Filters extends the popular Ajax Load More plugin (vendor CPE connekt_media:ajax_load_more_-_filters) to build taxonomy/term-based filter UIs that fetch posts asynchronously. The 'taxonomy_include_children' parameter - normally a boolean controlling whether child terms of a taxonomy are included in a query - is reflected into generated page markup without sufficient input sanitization or output escaping, so attacker-controlled values are stored and later rendered as live HTML/JS rather than inert text.

RemediationAI

No vendor-released patch version is identified in the available data; affected versions are stated as all releases up to and including 3.4.1, so administrators should monitor https://ajaxloadmore.com/add-ons/filters/ and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8d9f73-8460-4bcb-a9f8-08eb058bcc09?source=cve) for a fixed release (expected to be the next version above 3.4.1) and upgrade immediately once published. Until a fix is available, deactivate the Filters add-on if the taxonomy-filter functionality is non-essential, which removes the vulnerable code path at the cost of losing dynamic filtering UI. As a compensating control, place a Web Application Firewall (such as Wordfence's) in front of the site to block requests containing script payloads in the 'taxonomy_include_children' parameter, accepting that WAF signatures may miss novel encodings, and restrict who can submit filter requests where feasible.