CVE-2026-15295

The Infinite Scroll – Ajax Load More plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in its admin settings, impacting all versions up to 7.0.1. This vulnerability allows authenticated attackers with administrator-level permissions to inject malicious scripts, which can execute when users access affected pages, posing a risk primarily to multi-site installations or those with unfiltered_html disabled. WordPress site administrators, especially those managing multi-site environments, should prioritize patching this vulnerability to mitigate potential exploitation.