The vulnerability lies in an inadequate sanitization and escaping routine for the data-button-label attribute in the Ajax Load More plugin. An authenticated user with Contributor-level privilege or higher can insert arbitrary HTML or JavaScript code that the plugin stores and later renders on pages that use the infinite‑scroll feature. When another user views the affected page, the injected script executes in that user's browser context, allowing the attacker to steal session cookies, deface content, or redirect users to malicious sites. The vulnerability directly compromises a site’s confidentiality and integrity for all visitors to the affected pages.

WordPress sites that have installed the Ajax Load More – Infinite Scroll plugin from dcooney, in any revision up to and including version 7.4.0.1.

The CVSS score of 6.4 indicates a moderate severity, while an EPSS score of less than 1 % suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers are required to authenticate with at least Contributor privileges within the affected WordPress installation to inject a payload, thus limiting the threat to sites with unauthorized or compromised contributor accounts. Once injected, however, the stored XSS executes automatically for any site visitor, making the impact far‑reaching for each load on populated page.