Unknown AJAX Load More vulnerabilities

2 CVEs affecting Unknown AJAX Load More, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15360, published 2026-08-05.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-15360, published 2026-08-05. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL…
• CVE-2026-6495, published 2026-05-18. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used…