VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 17 known issues Latest disclosed Jan 30, 2026

Ajax Load More – Infinite Scroll, Load More, & Lazy Load Vulnerabilities

Review known vulnerability records for the WordPress plugin Ajax Load More – Infinite Scroll, Load More, & Lazy Load (`ajax-load-more`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-15525, CVE-2025-59582 and CVE-2025-4775, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
17
High or Critical
4
Patch Coverage
100%
Last Updated
Jan 31, 2026
Related Security Guides

Use these guides while reviewing Ajax Load More – Infinite Scroll, Load More, & Lazy Load fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Ajax Load More – Infinite Scroll, Load More, & Lazy Load remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
15
1. Match the Package
Confirm the installed WordPress plugin slug is ajax-load-more before acting on any CVE from this cluster.
2. Sort by Severity
Start with 4 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
17 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2015-10140 High
Remote Code Execution remediation for Ajax Load More – Infinite Scroll, Load More, & Lazy Load

Affected range: Versions up to 2.8.1.1. Fixed version: 2.8.1.2.

CVE-2022-2433 High
Cross-Site Request Forgery remediation for Ajax Load More – Infinite Scroll, Load More, & Lazy Load

Affected range: Versions up to 5.5.3. Fixed version: 5.5.4.

CVE-2021-24140 High
SQL Injection remediation for Ajax Load More – Infinite Scroll, Load More, & Lazy Load

Affected range: Versions before 5.3.2. Fixed version: 5.3.2.

CVE-2025-4775 Medium
Stored Cross-Site Scripting remediation for Ajax Load More – Infinite Scroll, Load More, & Lazy Load

Affected range: Versions up to 7.4.0.1. Fixed version: 7.4.1.

Priority CVE Quick Links

Fast paths into Ajax Load More – Infinite Scroll, Load More, & Lazy Load CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
14
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2015-10140
WordPress Infinite Scroll – Ajax Load More <= 2.8.1.1 - Arbitrary File Upload
 Remote Code Execution Versions up to 2.8.1.1 2.8.1.2 CVSS 8.8
CVE-2022-2433
WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to...
 Cross-Site Request Forgery Versions up to 5.5.3 5.5.4 CVSS 7.5
CVE-2021-24140
Ajax Load More plugin < 5.3.2 - SQL Injection
 SQL Injection Versions before 5.3.2 5.3.2 CVSS 7.2
CVE-2025-4775
WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+)...
 Stored Cross-Site Scripting Versions up to 7.4.0.1 7.4.1 CVSS 6.4
CVE-2025-47630
Ajax Load More <= 7.3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions up to 7.3.1.2 7.3.1.3 CVSS 6.4
CVE-2024-8505
WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) S...
 Stored Cross-Site Scripting Versions up to 7.1.2 7.1.3 CVSS 6.4
CVE-2024-4711
WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) C...
 Stored Cross-Site Scripting Versions up to 7.1.1 7.1.2 CVSS 6.4
CVE-2023-50874
WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 - Authenticated (Contributor+)...
 Stored Cross-Site Scripting Versions up to 6.1.0.1 6.2 CVSS 6.4
CVE-2015-10140 High 2.8.1.2
CVE-2015-10140 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Remote Code Execution

WordPress Infinite Scroll – Ajax Load More <= 2.8.1.1 - Arbitrary File Upload

CVE-2022-2433 High 5.5.4
CVE-2022-2433 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Cross-Site Request Forgery

WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization

CVE-2021-24140 High 5.3.2
CVE-2021-24140 Ajax Load More – Infinite Scroll, Load More, & Lazy Load SQL Injection

Ajax Load More plugin < 5.3.2 - SQL Injection

CVE-2025-4775 Medium 7.4.1
CVE-2025-4775 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Stored Cross-Site Scripting

WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting

CVE-2025-47630 Medium 7.3.1.3
CVE-2025-47630 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Stored Cross-Site Scripting

Ajax Load More <= 7.3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-8505 Medium 7.1.3
CVE-2024-8505 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Stored Cross-Site Scripting

WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter

CVE-2024-4711 Medium 7.1.2
CVE-2024-4711 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Stored Cross-Site Scripting

WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting

CVE-2023-50874 Medium 6.2
CVE-2023-50874 Ajax Load More – Infinite Scroll, Load More, & Lazy Load Stored Cross-Site Scripting

WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Ajax Load More – Infinite Scroll, Load More, & Lazy Load so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
17 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 3 high severity findings.
Recent CVEs
CVE-2025-15525, CVE-2025-59582 and CVE-2025-4775
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Ajax Load More – Infinite Scroll, Load More, & Lazy Load

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-15525
CVE-2025-15525: Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure

The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticate...

Published
Jan 30, 2026
Patched Release
7.8.2
Affected Versions
Versions up to 7.8.1
Next Step
Update to 7.8.2 or newer if supported.
Review CVE-2025-15525 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-59582
CVE-2025-59582: Ajax Load More <= 7.6.0.2 - Unauthenticated Sensitive Information Exposure

The Ajax Load More – Infinite Scroll plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.6.0.2. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Published
Sep 22, 2025
Patched Release
7.6.1
Affected Versions
Versions up to 7.6.0.2
Next Step
Update to 7.6.1 or newer if supported.
Review CVE-2025-59582 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-4775
CVE-2025-4775: WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possib...

Published
Jun 16, 2025
Patched Release
7.4.1
Affected Versions
Versions up to 7.4.0.1
Next Step
Update to 7.4.1 or newer if supported.
Review CVE-2025-4775 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-47630
CVE-2025-47630: Ajax Load More <= 7.3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
May 07, 2025
Patched Release
7.3.1.3
Affected Versions
Versions up to 7.3.1.2
Next Step
Update to 7.3.1.3 or newer if supported.
Review CVE-2025-47630 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-8505
CVE-2024-8505: WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for aut...

Published
Oct 01, 2024
Patched Release
7.1.3
Affected Versions
Versions up to 7.1.2
Next Step
Update to 7.1.3 or newer if supported.
Review CVE-2024-8505 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-4711
CVE-2024-4711: WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authent...

Published
May 31, 2024
Patched Release
7.1.2
Affected Versions
Versions up to 7.1.1
Next Step
Update to 7.1.2 or newer if supported.
Review CVE-2024-4711 fixed version details Open CVE Reference
Plugin Medium Patched: Yes
Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att...

Published
Mar 28, 2024
Patched Release
7.0.2
Affected Versions
Versions up to 7.0.1
Next Step
Update to 7.0.2 or newer if supported.
Review Ajax Load More – Infinite Scroll, Load More, & Lazy Load vulnerability details
Plugin Medium Patched: Yes CVE-2024-1790
CVE-2024-1790: Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the con...

Published
Mar 26, 2024
Patched Release
7.1.0
Affected Versions
Versions up to 7.0.1
Next Step
Update to 7.1.0 or newer if supported.
Review CVE-2024-1790 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-50874
CVE-2023-50874: WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in all versions up to 6.1.0.1 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Published
Dec 22, 2023
Patched Release
6.2
Affected Versions
Versions up to 6.1.0.1
Next Step
Update to 6.2 or newer if supported.
Review CVE-2023-50874 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-4466
CVE-2022-4466: WordPress Infinite Scroll - Ajax Load More <= 5.6.0.2 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode

The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.6.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This ma...

Published
Feb 27, 2023
Patched Release
5.6.0.3
Affected Versions
Versions up to 5.6.0.2
Next Step
Update to 5.6.0.3 or newer if supported.
Review CVE-2022-4466 fixed version details Open CVE Reference
Plugin Medium Patched: Yes
Infinite Scroll – Ajax Load More <= 5.5.4 - Authenticated (Admin+) Arbitrary File Read via Directory Traversal

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to arbitrary file download via directory traversal due to insufficient file path validation returned via the alm_repeaters_export() function in versions up to, and including, 5.5.4. This makes it po...

Published
Aug 31, 2022
Patched Release
5.5.4.1
Affected Versions
Versions up to 5.5.4
Next Step
Update to 5.5.4.1 or newer if supported.
Review Ajax Load More – Infinite Scroll, Load More, & Lazy Load vulnerability details
Plugin High Patched: Yes CVE-2022-2433
CVE-2022-2433: WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wra...

Published
Aug 22, 2022
Patched Release
5.5.4
Affected Versions
Versions up to 5.5.3
Next Step
Update to 5.5.4 or newer if supported.
Review CVE-2022-2433 fixed version details Open CVE Reference