CVE-2026-8141: Ajax Load More Filters XSS Vulnerability

CVE-2026-8141 Overview

CVE-2026-8141 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ajax Load More - Filters plugin for WordPress. The flaw affects all plugin versions up to and including 3.4.1. The taxonomy_include_children parameter lacks sufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary JavaScript that executes in the browser of any user viewing an affected page. The vulnerability is classified under [CWE-79] and carries a network-based attack vector requiring no privileges or user interaction.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and drive-by redirection.

Affected Products

Ajax Load More - Filters plugin for WordPress, all versions through 3.4.1
WordPress installations using the Filters add-on for Ajax Load More
Any site exposing the vulnerable taxonomy_include_children parameter

Discovery Timeline

2026-06-30 - CVE-2026-8141 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-8141

Vulnerability Analysis

The vulnerability resides in how the Ajax Load More - Filters plugin processes the taxonomy_include_children parameter. The plugin fails to sanitize incoming values on input and does not escape them on output. Attacker-controlled data is written into rendered HTML without neutralization. When the affected page is later viewed, the injected script executes in the victim's browser under the site's origin. Because the payload is stored, every visitor to the affected page becomes a target until the content is cleaned.

Root Cause

The root cause is missing input validation and missing output escaping around the taxonomy_include_children parameter. WordPress provides helpers such as sanitize_text_field() for input and esc_attr() or esc_html() for output. The plugin does not apply these routines to the affected parameter. This omission allows raw HTML and JavaScript to persist in the stored value and reach the DOM verbatim.

Attack Vector

An unauthenticated remote attacker submits a crafted request that places a malicious payload into the taxonomy_include_children parameter. The payload is stored by the plugin and later reflected into pages rendered to end users. Exploitation requires no authentication and no user interaction beyond visiting the affected page. The scope is changed because scripts execute in the security context of the WordPress site, allowing an attacker to reach administrator sessions and privileged actions.

No public proof-of-concept code is available. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-8141

Indicators of Compromise

Requests to WordPress endpoints containing taxonomy_include_children with <script>, onerror=, javascript:, or encoded angle brackets
Unexpected <script> tags or event-handler attributes in rendered pages that use the Ajax Load More Filters shortcode
Outbound requests from visitor browsers to unfamiliar domains immediately after loading filtered archive pages
New or modified WordPress posts, options, or postmeta rows containing HTML in the taxonomy_include_children field

Detection Strategies

Inspect web server access logs for query strings and POST bodies referencing taxonomy_include_children with HTML metacharacters
Deploy web application firewall (WAF) rules that flag script tags and JavaScript event handlers in plugin parameters
Run database queries against wp_postmeta and wp_options for stored values containing <script or on[a-z]+= patterns

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/plugins/ directory
Alert on new administrator account creation and privilege changes following suspicious plugin traffic
Correlate WAF alerts with authenticated admin session activity to identify successful XSS-driven account compromise

How to Mitigate CVE-2026-8141

Immediate Actions Required

Update the Ajax Load More - Filters plugin to a version later than 3.4.1 once a patched release is published by the vendor
Audit stored post, option, and taxonomy content for existing injected payloads and remove them
Rotate credentials for any administrator accounts that may have accessed affected pages while the vulnerability was live

Patch Information

At time of publication, versions through 3.4.1 are affected. Consult the Ajax Load More Filters Add-on page and the Wordfence Vulnerability Report for current patch availability and release notes.

Workarounds

Deactivate the Ajax Load More - Filters plugin until a patched version is installed
Deploy a WAF rule that blocks HTML metacharacters in the taxonomy_include_children parameter
Restrict access to pages using the affected shortcode via network controls where feasible
Enforce a strict Content Security Policy that disallows inline scripts to reduce XSS impact

bash

# Example WAF rule (ModSecurity) to block HTML in the vulnerable parameter
SecRule ARGS:taxonomy_include_children "@rx (?i)(<script|on\w+\s*=|javascript:|<iframe)" \
  "id:1026814,phase:2,deny,status:403,log,msg:'CVE-2026-8141 XSS attempt in taxonomy_include_children'"