The WordPress Ajax Load More and Infinite Scroll plugin contains an insufficient input sanitization flaw that allows an authenticated attacker with Contributor level or higher to inject arbitrary JavaScript into the "id" parameter. The injected script is persisted in the database and will execute in the browser of any user who visits the affected page, enabling malicious actions such as defacement, cookie theft, or session hijacking. This stored XSS defect directly compromises both the confidentiality and integrity of the user experience on pages that use the plugin.

The vulnerability impacts versions of the WordPress Ajax Load More and Infinite Scroll plugin released by tushargohel that are 1.6.0 or older. Any WordPress site running one of these affected releases and granting Contributor or higher level users access to the plugin is vulnerable.

Because the flaw requires an authenticated contributor or higher, an attacker must first establish a valid user account on the target WordPress site. Once authenticated, the attacker can inject malicious script that will be executed for every subsequent user viewing the injected page, rendering exploitation highly effective. The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% signals a low but nonzero probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog, so no known mass exploitation campaigns have yet been reported.