CVE-2026-15295 Overview
CVE-2026-15295 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Infinite Scroll – Ajax Load More plugin. The flaw affects all versions up to and including 7.0.1 and stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages. The issue is classified under [CWE-692] (Incomplete Denylist to Cross-Site Scripting). Exploitation is limited to multi-site installations and installations where the unfiltered_html capability has been disabled.
Critical Impact
Authenticated administrators on WordPress multi-site environments can store malicious JavaScript through plugin settings, enabling script execution against any user visiting the affected pages.
Affected Products
- WordPress Infinite Scroll – Ajax Load More plugin versions up to and including 7.0.1
- WordPress multi-site installations running the affected plugin
- WordPress installations where the unfiltered_html capability has been disabled
Discovery Timeline
- 2026-07-10 - CVE-2026-15295 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-15295
Vulnerability Analysis
The vulnerability resides in the administrative settings interface of the Ajax Load More plugin. User-supplied values submitted through the admin settings are stored in the WordPress database without adequate sanitization. When these values render on front-end pages, the plugin fails to properly escape output, allowing stored HTML and JavaScript payloads to execute in the browsers of visitors.
The attack surface is narrow. WordPress administrators normally hold the unfiltered_html capability, which permits raw HTML in posts and settings by design. On single-site installations with default capabilities, the injection is treated as legitimate content. Exploitation only becomes a security boundary violation on multi-site networks or when unfiltered_html has been explicitly stripped, since site-level administrators in those contexts are not trusted to insert raw scripts.
Root Cause
The plugin's settings handler does not enforce a strict allowlist for HTML tags and attributes. Input is persisted without invoking WordPress core sanitization helpers such as sanitize_text_field() or wp_kses(), and the corresponding output routines omit escaping helpers like esc_html() or esc_attr(). This double failure (input and output) meets the [CWE-692] pattern of an incomplete denylist against XSS.
Attack Vector
An authenticated attacker with administrator privileges navigates to the Ajax Load More settings page and submits a payload containing a <script> tag or an HTML attribute with an event handler. The payload is stored in plugin options. When a visitor loads a page that renders the tainted setting, the browser parses and executes the attacker's script in the context of the site's origin, enabling session theft, forced administrative actions, or redirection to attacker infrastructure.
No verified exploit code has been published. Technical details are documented in the WordPress Plugin Changeset and the Wordfence Vulnerability Report.
Detection Methods for CVE-2026-15295
Indicators of Compromise
- Unexpected <script> tags or on* event handler attributes stored in the wp_options rows associated with ajax-load-more
- Outbound requests from site visitors to unknown domains originating from pages that embed Ajax Load More output
- New or modified administrator accounts on multi-site networks with recent access to the plugin settings page
Detection Strategies
- Audit the plugin's option values in the WordPress database for HTML or JavaScript content that does not match expected configuration strings
- Review web server access logs for administrator POST requests to wp-admin/admin.php?page=ajax-load-more followed by anomalous front-end traffic
- Enable a Content Security Policy (CSP) in report-only mode to surface inline script executions on pages using the plugin
Monitoring Recommendations
- Alert on modifications to plugin option rows outside of scheduled maintenance windows
- Track administrator session activity on multi-site super-admin and site-admin roles for unusual settings changes
- Correlate DOM-based script execution telemetry with page URLs that render Ajax Load More shortcodes
How to Mitigate CVE-2026-15295
Immediate Actions Required
- Upgrade the Infinite Scroll – Ajax Load More plugin to a version later than 7.0.1 that contains the sanitization fix
- Audit multi-site networks and any environment where unfiltered_html has been removed for injected content in plugin settings
- Rotate administrator credentials and invalidate active sessions if unauthorized settings changes are detected
Patch Information
The vendor addressed the issue in the plugin repository. The corrective changes are documented in the WordPress Plugin Changeset, which introduces proper input sanitization and output escaping on the affected admin settings fields. Site operators should update through the WordPress plugin manager or by deploying the patched release directly.
Workarounds
- Restrict access to the plugin settings page to trusted super-administrators only on multi-site networks
- Deploy a strict Content Security Policy that disallows inline scripts on pages rendering Ajax Load More output
- Temporarily deactivate the plugin on multi-site installations until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
