Vulnerabilidades do Dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy Load
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy Load: 2 registro(s), com versões afetadas e correções.
CVE-2026-15295
Média · 4.4
CWE-692 10/07/2026
Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVE-2025-15525
Média · 5.3
CWE-863 31/01/2026
Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.