Stored Cross-Site Scripting in WordPress Ajax Load More Plugin

CVE-2025-5586

What is CVE-2025-5586?

The Ajax Load More and Infinite Scroll plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping concerning the 'id' parameter. This flaw affects all versions up to and including 1.6.0. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject malicious web scripts into pages. The scripts will execute in the browser of users accessing the compromised pages, exposing them to potential theft of sensitive information and other security risks.

References