CVE-2026-6495 AKAOMA CVE VULNERABILITIES / 16h The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Back cve.akaoma.com

CVE-2026-6495 AKAOMA CVE VULNERABILITIES / 16h The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

cve.akaoma.com • May 19, 2026

Share: View original

7.1 /10 Very High Risk Highly exploitable, CVE-2026-6495 poses a critical security risk that could lead to severe breaches.

Highly exploitable, CVE-2026-6495 poses a critical security risk that could lead to severe breaches.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical XSS Vulnerability in Ajax Load More Plugin Affects WordPress Administrators A reflected cross-site scripting (XSS) vulnerability, identified as CVE-2026-6495, affects the Ajax Load More WordPress plugin prior to version 7.8.4. This flaw allows unauthenticated attackers to craft malicious URLs that execute JavaScript in the context of high-privilege users, such as administrators. The vulnerability has a CVSS score of 7.1, indicating a high severity level. Currently, there is no public proof-of-concept or evidence of exploitation. Users are advised to upgrade to version 7.8.4 or later to mitigate the risk. Temporary measures include restricting access to the plugin or disabling it until patched. The vulnerability was first published on May 18, 2026, and has been reported by multiple cybersecurity sources. 3 sources 65

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Cwe-79 - Cross-site Scripting (xss)

Platforms (1)

Vulnerabilities (1)