WordPress Infinite Scroll Vulnerability – Ajax Load More – Authenticated (Administrator+) Stored Cross-Site Scripting | WordPress Plugin Vulnerability Report

Plugin Name: WordPress Infinite Scroll – Ajax Load More

Key Information:

  • Software Type: Plugin
  • Software Slug: ajax-load-more
  • Software Status: Active
  • Software Author: connekthq
  • Software Downloads: 1,881,197
  • Active Installs: 50,000
  • Last Updated: April 1, 2024
  • Patched Versions: 7.0.2
  • Affected Versions: <= 7.0.1

Vulnerability Details:

  • Name: Ajax Load More <= 7.0.1
  • Title: Authenticated (Administrator+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVSS Score: 4.4
  • Publicly Published: March 28, 2024
  • Researcher: afei - NASA
  • Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts that execute whenever a user accesses an injected page. This vulnerability specifically affects multi-site installations and instances where unfiltered_html is disabled.


The WordPress Infinite Scroll – Ajax Load More plugin for WordPress has a vulnerability in versions up to and including 7.0.1 that allows for Stored Cross-Site Scripting via the admin settings due to insufficient input sanitization and output escaping. This vulnerability has been patched in version 7.0.2.

Detailed Overview:

The vulnerability was discovered by researcher afei from NASA and involves the potential for authenticated attackers with administrative permissions to inject harmful scripts into web pages through the plugin's admin settings. This risk primarily impacts WordPress multi-site installations and sites where unfiltered_html capability is disabled, allowing the injected scripts to run when a user accesses the compromised pages. The nature of the vulnerability necessitates immediate attention and remediation to prevent potential exploits.

Advice for Users:

  • Immediate Action: Update the WordPress Infinite Scroll – Ajax Load More plugin to the patched version 7.0.2 immediately.
  • Check for Signs of Vulnerability: Monitor your website for any unusual activity or unauthorized changes to web pages, which may indicate that the vulnerability has been exploited.
  • Alternate Plugins: Consider using alternative plugins that offer similar functionality as a precaution, even though a patch is available.
  • Stay Updated: Regularly update all WordPress plugins to their latest versions to protect against known vulnerabilities.


The prompt action by the developers of the WordPress Infinite Scroll – Ajax Load More plugin to release a patched version highlights the critical importance of maintaining up-to-date software. Users are strongly advised to update to version 7.0.2 or later to safeguard their WordPress installations against this vulnerability.


Detailed Report:

In the ever-evolving digital landscape, the security of online platforms is paramount for businesses large and small. A recent discovery within the WordPress ecosystem highlights this ongoing battle against cyber threats. The popular "WordPress Infinite Scroll – Ajax Load More" plugin, a tool designed to enhance user experience by seamlessly loading content, was found to contain a significant security vulnerability. This revelation serves as a critical reminder of the importance of vigilance and regular maintenance in safeguarding digital assets.

Plugin Overview:

"WordPress Infinite Scroll – Ajax Load More" is a widely used plugin with over 50,000 active installations. Developed by connekthq, it has seen more than 1.8 million downloads. Its main purpose is to improve site engagement by allowing continuous content loading without the need for pagination.

Vulnerability Details:

The vulnerability identified is classified as an "Authenticated (Administrator+) Stored Cross-Site Scripting" issue. Present in versions up to and including 7.0.1, it arises from insufficient input sanitization and output escaping within the plugin's admin settings. This flaw enables attackers with administrative access to inject malicious scripts into web pages, which are then executed whenever a user accesses these pages. Particularly at risk are multi-site installations and sites where the unfiltered_html capability is disabled.

Risks and Impacts:

The implications of this vulnerability cannot be understated. It opens the door for attackers to potentially take control of affected websites, compromise user data, and distribute malware, thereby eroding trust and potentially causing significant harm to a business's reputation and operations.


In response to this discovery, the developers released a patched version (7.0.2) to address the vulnerability. The immediate course of action for website owners is to update the plugin to this latest version. Additionally, it's advisable to conduct a thorough review of site activity and content to check for signs of compromise.

Historical Context:

This is not the first instance of vulnerability within this plugin; there have been 10 previous vulnerabilities reported since October 11, 2015. This history underscores the reality that software vulnerabilities are not a matter of "if" but "when," highlighting the critical need for ongoing vigilance.

The Importance of Proactive Security Measures:

For small business owners managing WordPress websites, the challenge of staying ahead of security threats can seem daunting, especially with limited time and resources. However, the consequences of neglect can be far more time-consuming and costly. Implementing routine updates, leveraging security plugins like Wordfence, and possibly engaging with cybersecurity professionals for regular audits can significantly mitigate these risks.


The recent vulnerability in the "WordPress Infinite Scroll – Ajax Load More" plugin is a stark reminder of the persistent and evolving nature of cyber threats. For small business owners, this serves as a call to action to prioritize website security. By adopting a proactive stance—regularly updating plugins, monitoring site activity, and seeking expert advice when needed—businesses can better protect themselves and their customers from the potentially devastating impacts of cyberattacks. In the digital age, the security of your online presence is not just an IT concern; it's a fundamental aspect of your business's resilience and reputation.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WordPress Infinite Scroll Vulnerability – Ajax Load More – Authenticated (Administrator+) Stored Cross-Site Scripting | WordPress Plugin Vulnerability Report FAQs

Leave a Comment