CVE-2026-6495

The Ajax Load More WordPress plugin, versions prior to 7.8.4, contains a reflected cross-site scripting (XSS) vulnerability. The plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing an attacker to inject arbitrary JavaScript code [1].

To exploit this vulnerability, an attacker must craft a malicious URL containing the unsanitized parameter and trick a victim into clicking it. The vulnerability is particularly dangerous because it can be used against high-privilege users, such as administrators, who have extensive access to the WordPress site [1].

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser. This could lead to session hijacking, defacement, or other malicious actions performed under the victim's privileges, potentially compromising the entire WordPress installation [1].

The vulnerability has been fixed in version 7.8.4 of the plugin. Users are strongly advised to update to the latest version to mitigate the risk. No workarounds have been provided by the vendor [1].