CVE-2025-15525: medium-severity vulnerability in dcooney Ajax Load More – Infinite Scroll, Load…
Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
dcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy LoadRelated CVEs — dcooney Ajax Load More – Infinite Scroll, Load…
In the same product, most dangerous first.
CVE-2022-2945MEDIUMWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory TraversalEPSS 1.8%CVE-2022-2943MEDIUMWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File ReadEPSS 1.7%CVE-2022-2433HIGHWordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR DeserializationEPSS 1.6%CVE-2024-1790MEDIUMAjax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File ReadEPSS 0.8%CVE-2024-4711MEDIUMWordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.4%CVE-2024-8505MEDIUMWordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label ParameterEPSS 0.4%