CVE-2026-8141 is a stored cross-site scripting vulnerability in the Ajax Load More - Filters plugin for WordPress, specifically via the 'taxonomy_include_children' parameter. Due to inadequate input sanitization and output escaping, attackers can inject arbitrary web scripts that persist and execute in the context of users visiting the injected pages. This vulnerability affects all versions up to and including 3.4.1. The CVSS 3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the vulnerable parameter if possible. Monitor the vendor's communications for updates on patches or official mitigations.