CVE-2026-15360
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Ajax Load More WordPress plugin before version 8.0.1 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
Risk Assessment
The risk involves potential unauthorized access to WordPress database data, including passwords, user data, and other confidential information, which could lead to site compromise.
Recommendation
Immediately update the Ajax Load More plugin to version 8.0.1 or later to remediate the SQL injection vulnerability.
Other vulnerabilities in Ajax Load More
See all- CVE-2026-15295Medium
The WordPress Infinite Scroll – Ajax Load More plugin up to version 7.0.1 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2025-59582Medium
The WordPress plugin Ajax Load More (versions up to and including 7.6.0.2) contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. This may allow retrieval of embedded sensitive data.
Original NVD description (English source)
The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS