CVE-2026-15295 is a stored Cross-Site Scripting vulnerability in the WordPress plugin 'Ajax Load More – Infinite Scroll, Load More, & Lazy Load' (dcooney) affecting all versions up to and including 7.0.1. The issue arises from incomplete denylist filtering (CWE-692) leading to insufficient input sanitization and output escaping in admin settings. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of users visiting the injected pages. This vulnerability specifically impacts multi-site WordPress installations and those with unfiltered_html disabled. The CVSS v3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. There is no vendor advisory or patch available at this time.

An attacker with administrator-level permissions can inject persistent malicious scripts into pages via the plugin's admin settings. These scripts execute in the browsers of users accessing the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability is limited to multi-site WordPress installations or those with unfiltered_html disabled. The overall impact is rated medium due to the required privileges and attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or replacing the affected plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.