PT-2024-6634 · WordPress · Wordpress Infinite Scroll – Ajax Load More

Robert Devore

·

Published

2024-09-05

·

Updated

2024-10-07

·

CVE-2024-8505

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: WordPress Infinite Scroll – Ajax Load More plugin versions up to, and including, 7.1.2
Description: The issue is related to insufficient input sanitization and output escaping, allowing for Stored Cross-Site Scripting attacks. This can be exploited by authenticated attackers with Contributor-level access and above, enabling them to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The button label parameter is specifically vulnerable to this type of attack.
Recommendations: For WordPress Infinite Scroll – Ajax Load More plugin versions up to, and including, 7.1.2: Update to a version higher than 7.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the button label parameter to minimize the risk of exploitation. Additionally, limiting Contributor-level access and above can help reduce the potential for attacks.

Fix

XSS

Weakness Enumeration

CWE-87CWE-79

Related Identifiers

BDU:2024-07796
CVE-2024-8505

Affected Products

Wordpress Infinite Scroll – Ajax Load More