The Ajax Load More WordPress plugin, for versions older than 7.8.4, fails to sanitise and escape a user‑supplied parameter before echoing it back in the page. This permits a reflected XSS attack that can execute arbitrary JavaScript in the browser context of users who load the affected page, particularly high‑privilege accounts such as administrators. An attacker could leverage this to steal session cookies, perform actions on behalf of the victim, or deface the site.

This flaw applies to the Ajax Load More plugin for WordPress, affecting any installation that uses a version earlier than 7.8.4. The exact version list is not enumerated in the advisory, but all pre‑7.8.4 releases are vulnerable.

The CVSS score in the advisory is 7.1, and the EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is classed as non‑KEV. Based on the description, the likely attack vector is a malicious URL or payload embedded in a query parameter that a user inadvertently visits, causing the reflected XSS payload to execute in the admin interface.