Vulnerabilities and security researches forajax-load-more ajax-load-more
Direction: ascendingJun 06, 2024
WordPress Infinite Scroll – Ajax Load More # CVE-2022-2433
- CVE, Research URL
- Application
- Date
- Sep 06, 2022
- Research Description
- The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2022-2943
- CVE, Research URL
- Application
- Date
- Sep 06, 2022
- Research Description
- The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2022-2945
- CVE, Research URL
- Application
- Date
- Sep 06, 2022
- Research Description
- The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2021-24140
- CVE, Research URL
- Application
- Date
- Mar 18, 2021
- Research Description
- Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2022-4466
- CVE, Research URL
- Application
- Date
- Mar 13, 2023
- Research Description
- The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2023-50874
- CVE, Research URL
- Application
- Date
- Dec 28, 2023
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2024-1790
- CVE, Research URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This is limited to Windows instances.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WordPress Infinite Scroll – Ajax Load More # CVE-2024-4711
- CVE, Research URL
- Application
- Date
- Jun 01, 2024
- Research Description
- The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Oct 02, 2024
WordPress Infinite Scroll – Ajax Load More # CVE-2024-8505
- CVE, Research URL
- Application
- Date
- Oct 02, 2024
- Research Description
- The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
May 08, 2025
WordPress Infinite Scroll – Ajax Load More # CVE-2025-47630
- CVE, Research URL
- Application
- Date
- May 07, 2025
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney Ajax Load More allows Stored XSS. This issue affects Ajax Load More: from n/a through 7.3.1.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable