CVE-2026-8141 is a stored cross-site scripting vulnerability in the Ajax Load More - Filters plugin for WordPress, affecting all versions up to and including 3.4.1. The issue stems from improper neutralization of input in the 'taxonomy_include_children' parameter, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. No official patch or remediation level has been confirmed as of the published date.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in users' browsers when they visit pages using the vulnerable plugin. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to affected pages. Applying web application firewall (WAF) rules to detect and block malicious payloads targeting the 'taxonomy_include_children' parameter may provide temporary mitigation.