The Ajax Load More plugin contains improper neutralization of input during web page generation, creating a stored XSS flaw that permits an attacker to inject and activate malicious script in the browser of any user who views a page rendered by the plugin. The vulnerability is a classic client‑side code injection identified as CWE‑79. The impact is that an attacker can execute arbitrary JavaScript in the victim’s browser, potentially enabling credential theft, session hijacking, site defacement, or delivery of malware. All sites that use the plugin are exposed because the injected script will run for every visitor who encounters the affected content.

The affected product is the WordPress plugin Ajax Load More, developed by Darren Cooney. Versions from the earliest release through 7.3.1.2 are vulnerable. WordPress sites that have this plugin installed and activated, especially those that accept user‑supplied content processed by the plugin, are at risk.

The CVSS score of 6.5 indicates moderate severity. An EPSS score of less than 1% suggests a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is through user‑controllable input that the plugin stores and later renders without proper sanitization, so an attacker can craft malicious payloads that are persistently executed for any viewer of the affected page. Successful exploitation would allow code execution in the victim’s browser context.