The Ajax Load More WordPress plugin prior to version 7.8.4 contains a reflected XSS vulnerability (CWE-79) due to improper sanitization and escaping of a parameter that is reflected in the page output. This allows an attacker to inject malicious scripts that could execute in the browsers of high privilege users, potentially leading to session hijacking or other malicious actions. No CVSS score or official remediation details are currently available.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of high privilege users, such as administrators. This may lead to unauthorized actions within the WordPress admin interface, session hijacking, or other attacks leveraging the elevated privileges of the victim. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Ajax Load More plugin updates and apply version 7.8.4 or later once available. Until a patch is confirmed, restricting access to the plugin's functionality to trusted users and employing web application firewalls that detect XSS attempts may help reduce risk.