Ajax Load More vulnerabilities

The Ajax Load More WordPress plugin before version 8.0.1 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

The WordPress Infinite Scroll – Ajax Load More plugin up to version 7.0.1 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages.

The WordPress plugin Ajax Load More (versions up to and including 7.6.0.2) contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. This may allow retrieval of embedded sensitive data.