CVE-2026-15295 dcooney CVE debrief

Who should care

Administrators of WordPress multi-site installations or installations where unfiltered_html has been disabled should assess and mitigate this vulnerability. Site owners, security teams, and administrators with access to plugin settings need to be aware of the potential risks and take appropriate actions to protect their sites. This includes verifying plugin versions, restricting administrator permissions, and monitoring for suspicious activity.

Technical summary

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Defensive priority

Medium priority due to the requirement for administrator-level permissions and the limited scope of exploitation. However, given the potential impact, it should be addressed promptly.

Recommended defensive actions

• Verify and update the Infinite Scroll – Ajax Load More plugin to a version beyond 7.0.1 if available.
• Restrict administrator-level permissions to trusted users.
• Monitor for suspicious admin activity and injected scripts.
• Consider disabling unfiltered_html if not required.
• Review and limit administrator access to plugin settings.
• Perform regular security audits and monitoring of site activity.
• Implement additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.

Evidence notes

Evidence is based on the CVE record and NVD detail provided. Further verification is recommended through official WordPress and plugin sources. The vulnerability affects multi-site installations and installations where unfiltered_html has been disabled. Defenders should verify the plugin version and configuration. Additional review of admin settings and user permissions is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.