Is Ajax Load More safe?

Every recorded flaw

• Aug 5, 2026Ajax Load More: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-15360 · fixed in 8.0.1 · reported by WPScanCritical 9.1
• Jul 10, 2026WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2026-15295 · affects up to 7.0.1 · reported by WordfenceMedium 4.4
• May 18, 2026Ajax Load More: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-6495 · fixed in 7.8.4 · reported by WPScanHigh 7.1
• Jan 31, 2026Ajax Load More – Infinite Scroll, Load More, & Lazy Load: Unauthorized access of dataCVE-2025-15525 · affects up to 7.8.1 · reported by WordfenceMedium 5.3
• Sep 22, 2025Ajax Load More: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59582 · affects up to 7.6.0.2 · reported by PatchstackMedium 5.3
• Jul 22, 2025The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to uploaCVE-2015-10140 · fixed in 2.8.1.2 · reported by WPScan1.7% oddsHigh 8.8
• Jun 16, 2025WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2025-4775 · affects up to 7.4.0.1 · reported by WordfenceMedium 6.4
• May 7, 2025Ajax Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47630 · affects up to 7.3.1.2 · reported by PatchstackMedium 6.5
• Oct 2, 2024WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2024-8505 · affects up to 7.1.2 · reported by WordfenceMedium 6.4
• May 31, 2024WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2024-4711 · affects up to 7.1.1 · reported by WordfenceMedium 6.4
• Apr 9, 2024WordPress Infinite Scroll – Ajax Load More: Path TraversalCVE-2024-1790 · affects up to 7.0.1 · reported by WordfenceMedium 4.9
• Dec 28, 2023WordPress Infinite Scroll – Ajax Load More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50874 · affects up to 6.1.0.1 · reported by PatchstackMedium 6.5
• Mar 13, 2023WordPress Infinite Scroll: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4466 · fixed in 5.6.0.3 · reported by WPScanMedium 5.4
• Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Directory TraversalCVE-2022-2945 · affects up to 5.5.3 · reported by Wordfence1.7% oddsMedium 4.9
• Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Arbitrary file readingCVE-2022-2943 · affects up to 5.5.3 · reported by Wordfence1.7% oddsMedium 4.9
• Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Deserialization of untrusted inputCVE-2022-2433 · affects up to 5.5.3 · reported by Wordfence1.6% oddsHigh 7.5
• Mar 18, 2021Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' orCVE-2021-24140 · fixed in 5.3.2 · reported by WPScan1.2% oddsHigh 7.2

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.