CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8505 – WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter
https://notcve.org/view.php?id=CVE-2024-8505
01 Oct 2024 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/core/classes/class-alm-shortcode.php • CWE-87: Improper Neutralization of Alternate XSS Syntax •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4711 – WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-4711
31 May 2024 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento WordPress Infinite Scroll – Ajax Load More para Wor... • https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/build/frontend/ajax-load-more.js • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33569 – WordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability
https://notcve.org/view.php?id=CVE-2024-33569
17 May 2024 — Improper Privilege Management vulnerability in Darren Cooney Instant Images allows Privilege Escalation.This issue affects Instant Images: from n/a through 6.1.0. Una vulnerabilidad de gestión de privilegios incorrecta en Darren Cooney Instant Images permite una escalada de privilegios. Este problema afecta a Instant Images: desde n/a hasta 6.1.0. • https://patchstack.com/database/vulnerability/instant-images/wordpress-instant-images-plugin-6-1-0-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve • CWE-269: Improper Privilege Management •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1790 – Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read
https://notcve.org/view.php?id=CVE-2024-1790
26 Mar 2024 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This is limited to Windows instances. El complemento WordPress Infinite Scroll – Ajax Load More para WordPress es vulnerable a Path Traversal en todas ... • https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/admin/functions/layouts.php#L14 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0869 – Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update
https://notcve.org/view.php?id=CVE-2024-0869
29 Jan 2024 — The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license REST API endpoint in all versions up to, and including, 6.1.0. This makes it possible for authors and higher to update arbitrary options. El complemento Instant Images – One Click Image Uploads from Unsplash, Openv... • https://plugins.trac.wordpress.org/browser/instant-images/tags/6.1.0/api/license.php#L91 • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50874 – WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50874
22 Dec 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1. Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Darren Cooney WordPress Infinite Scroll – Ajax Load More permite XSS almacenado. Este problema afecta a WordPress Infinite ... • https://patchstack.com/database/vulnerability/ajax-load-more/wordpress-ajax-load-more-plugin-6-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27451 – WordPress Instant Images Plugin <= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF)
https://notcve.org/view.php?id=CVE-2023-27451
02 Mar 2023 — Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions. Vulnerabilidad de Server-Side Request Forgery (SSRF) en el complemento Darren Cooney Instant Images en versiones <=5.1.0.2. The Instant Images plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 5.1.0.1via the instant_images_download function. This can allow authenticated attackers, with author-level permissions and above, to make web requests to arb... • https://patchstack.com/database/vulnerability/instant-images/wordpress-instant-images-5-1-0-1-auth-server-side-request-forgery-ssrf-vulnerability?_s_id=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4466 – WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4466
27 Feb 2023 — The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.6.0.2 due to insufficient in... • https://wpscan.com/vulnerability/497d0bf9-b750-4293-9662-1722a74442e2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2943 – WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read
https://notcve.org/view.php?id=CVE-2022-2943
22 Aug 2022 — The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file. El plugin WordPress Infinite Scroll - Ajax Load More para Wordpress es vulnerable ... • https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2945 – WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal
https://notcve.org/view.php?id=CVE-2022-2945
22 Aug 2022 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information. El plugin WordPress Infinite Scroll - Ajax Load More para WordPress es vulnerable a un Salto de Directorio en versiones h... • https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •