Critical XSS Vulnerability in Ajax Load More Plugin Affects WordPress Administrators

A reflected cross-site scripting (XSS) vulnerability, identified as CVE-2026-6495, affects the Ajax Load More WordPress plugin prior to version 7.8.4. This flaw allows unauthenticated attackers to craft malicious URLs that execute JavaScript in the context of high-privilege users, such as administrators. The vulnerability has a CVSS score of 7.1, indicating a high severity level. Currently, there is no public proof-of-concept or evidence of exploitation. Users are advised to upgrade to version 7.8.4 or later to mitigate the risk. Temporary measures include restricting access to the plugin or disabling it until patched. The vulnerability was first published on May 18, 2026, and has been reported by multiple cybersecurity sources.

Key Points: • CVE-2026-6495 is a reflected XSS vulnerability in the Ajax Load More plugin for WordPress. • The flaw allows attackers to execute JavaScript in the browser of high-privilege users. • Users must upgrade to version 7.8.4 or later to mitigate the risk of exploitation.