A cross-site scripting vulnerability in the Ajax Load More WordPress plugin allows attackers to execute arbitrary scripts in the browser of a victim user.

This is a Cross-Site Scripting (XSS) vulnerability (CWE-79) affecting the plugin. It is exploitable by an unauthenticated attacker, although it requires user interaction to execute the malicious payload.

The vulnerability allows attackers to inject malicious scripts into pages viewed by other users, including administrators. This can lead to the compromise of administrative sessions, modification of website content, or redirection of users to malicious sites, significantly impacting the site's reputation and security posture.

Immediate Action: Update the "Ajax Load More – Infinite Scroll, Load More, & Lazy Load" plugin to version 7.8.4 or later immediately.

Proactive Monitoring: Review WordPress audit logs for unusual administrative activity or changes to plugin settings that may indicate a compromised session.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block common XSS injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown

Site administrators should prioritize updating the Ajax Load More plugin to the latest version. Because proof-of-concept material exists, the risk of exploitation is elevated, necessitating a prompt update to maintain the security of the WordPress installation.