CVE-2025-59582
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The WordPress plugin Ajax Load More (versions up to and including 7.6.0.2) contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. This may allow retrieval of embedded sensitive data.
Risk Assessment
An attacker may gain access to sensitive system information, which could facilitate further attacks on the WordPress site. This may lead to a breach of data confidentiality.
Recommendation
Update the Ajax Load More plugin to a version later than 7.6.0.2 as soon as a fix is available. Until then, consider disabling the plugin.
Other vulnerabilities in Ajax Load More
See all- CVE-2026-15360Critical
The Ajax Load More WordPress plugin before version 8.0.1 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
- CVE-2026-15295Medium
The WordPress Infinite Scroll – Ajax Load More plugin up to version 7.0.1 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through <= 7.6.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS