The Ajax Load More – Infinite Scroll, Load More, & Lazy Load WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the data-button-label HTML attribute. Authenticated users with Contributor-level access or above can inject arbitrary scripts that persist and execute in other users' browsers when they view the compromised page. This vulnerability affects all versions up to and including 7.4.0.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch link currently available, and the plugin is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject persistent malicious scripts into pages rendered by the plugin. This can lead to unauthorized actions performed in the context of other users' browsers, potentially compromising user data confidentiality and integrity. There is no impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Contributor-level access or higher to trusted users only. Monitoring for unusual script injections in the data-button-label attribute and disabling or removing the plugin temporarily may reduce risk. Avoid relying on generic mitigations not directly related to this vulnerability.