CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4711 – WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-4711
31 May 2024 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento WordPress Infinite Scroll – Ajax Load More para Wor... • https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/build/frontend/ajax-load-more.js • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50874 – WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50874
22 Dec 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1. Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Darren Cooney WordPress Infinite Scroll – Ajax Load More permite XSS almacenado. Este problema afecta a WordPress Infinite ... • https://patchstack.com/database/vulnerability/ajax-load-more/wordpress-ajax-load-more-plugin-6-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4466 – WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4466
27 Feb 2023 — The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 5.6.0.2 due to insufficient in... • https://wpscan.com/vulnerability/497d0bf9-b750-4293-9662-1722a74442e2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2943 – WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read
https://notcve.org/view.php?id=CVE-2022-2943
22 Aug 2022 — The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file. El plugin WordPress Infinite Scroll - Ajax Load More para Wordpress es vulnerable ... • https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2945 – WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal
https://notcve.org/view.php?id=CVE-2022-2945
22 Aug 2022 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information. El plugin WordPress Infinite Scroll - Ajax Load More para WordPress es vulnerable a un Salto de Directorio en versiones h... • https://gist.github.com/Xib3rR4dAr/f9a4b4838154854ec6cde7d5deb76bf9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2433 – WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization
https://notcve.org/view.php?id=CVE-2022-2433
22 Aug 2022 — The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP ch... • https://plugins.trac.wordpress.org/changeset/2772627/ajax-load-more/trunk/admin/admin.php • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24140 – Ajax Load More < 5.3.2 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2021-24140
18 May 2020 — Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test. Una entrada no comprobada en el plugin Ajax Load More de WordPress, versiones anteriores a 5.3.2, conlleva a una inyección SQL en el archivo POST /wp-admin/admin-ajax.php con param repeater=' o sleep(5)#&type=test • https://wpscan.com/vulnerability/1876312e-3dba-4909-97a5-afbb76fbc056 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •