CVE-2026-15295 is a stored cross-site scripting vulnerability in the WordPress plugin 'Ajax Load More – Infinite Scroll, Load More, & Lazy Load' (dcooney). The flaw is due to incomplete denylist filtering (CWE-692) that fails to properly sanitize and escape input in admin settings, enabling authenticated administrators to inject arbitrary scripts. These scripts execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 7.0.1 and is limited to multi-site installations or those with unfiltered_html disabled. No official patch or remediation level has been published as of the data provided.

An authenticated attacker with administrator-level permissions can exploit this vulnerability to inject stored malicious scripts into pages. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The impact is limited to multi-site WordPress setups or installations where unfiltered_html is disabled. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to trusted users only and consider disabling or limiting the use of the affected plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.