CVE-2026-6495

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

May 18, 2026

Last Seen

May 19, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical XSS Vulnerability in Ajax Load More Plugin Affects WordPress Administrators64.5

A reflected cross-site scripting (XSS) vulnerability, identified as CVE-2026-6495, affects the Ajax Load More WordPress plugin prior to version 7.8.4. This flaw allows unauthenticated attackers to craft malicious URLs that execute JavaScript in the context of high-privilege users, such as administra...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical XSS Vulnerability in Ajax Load More Plugin Affects WordPress Administrators

May 19·3 sources

Related Articles (3)

CVE-2026-6495 AKAOMA CVE VULNERABILITIES / 16h The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

cve.akaoma.com·May 19

CVE-2026-6495 INCIBE-CERT - Vulnerabilities RSS / 13h CVE-2026-6495 Título es CVE-2026-6495 Lun, 18/05/2026 - 07:16 Gravedad 2.0 Txt Pendiente de análisis Título en CVE-2026-6495 Descripción en The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin 18/05/2026 18/05/2026 Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Sco

www.incibe.es·May 19

CVE-2026-6495 - Exploits & Severity

Related Entities

Cwe-79 - Cross-site Scripting (xss)T1059 - Command and Scripting Interpreter WordPress XSS Reflected Cross-Site Scripting