CVE-2026-8141: Ajax Load More – Filters WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-8141 is a stored XSS vulnerability (CWE-79) in Ajax Load More – Filters that stems from insufficient input sanitization on the 'taxonomy_include_children' parameter. The plugin fails to properly validate or escape this user-controllable input before storing and rendering it in page output. Because the injection persists in the database, the malicious payload executes for every user who loads the affected page, making this a high-severity stored variant rather than a reflected attack. The vulnerability is reachable via unauthenticated requests, eliminating any authentication barrier to exploitation.

Business impact

A successful attack could undermine visitor trust and site integrity. Attackers could redirect users to malicious sites, harvest credentials, inject phishing content, or deploy malware. If your WordPress site attracts customers or business partners, a stored XSS attack could compromise their sessions, steal sensitive data, or damage your reputation. Additionally, removing injected payloads requires database cleanup, potentially requiring site downtime or forensic investigation.

Affected systems

WordPress installations running the Ajax Load More – Filters plugin in any version up to and including 3.4.1 are affected. The vulnerability is reachable without authentication, so any publicly accessible WordPress site using this plugin is at risk. Multisite WordPress deployments where individual sites use this plugin are similarly affected.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.2 (HIGH) with an attack vector of Network, requiring no authentication or user interaction for successful exploitation. An attacker can craft a malicious request targeting the 'taxonomy_include_children' parameter and inject arbitrary JavaScript into the page. Because the attack is pre-stored, no social engineering is required to trick users into clicking a link—the payload executes automatically on page load. The low barrier to exploitation combined with the broad reach of public websites makes this a practical target for attackers.

Remediation

Update the Ajax Load More – Filters plugin to a patched version that properly sanitizes the 'taxonomy_include_children' parameter and escapes all output. Verify the current version installed on your WordPress site via the Plugins dashboard. After updating, inspect your site's pages and posts for any injected content in case exploitation occurred prior to patching. If your site was compromised, consider running a security audit and monitoring access logs for suspicious activity.

Patch guidance

Verify the latest patched version of Ajax Load More – Filters against the vendor's official plugin repository and advisory documentation. Update through the WordPress admin interface (Plugins → Updates) or download directly from the official source. Test the update on a staging environment first if possible to ensure compatibility with your site's other plugins and themes. After patching, clear any active caches to ensure the new version is served to all visitors.

Detection guidance

Review WordPress logs and plugin update history to determine when your site was last running a vulnerable version. Search your WordPress database and post/page content for suspicious JavaScript, iframe tags, or unusual script tags that may have been injected into the 'taxonomy_include_children' field or related filter data. Monitor browser console errors and network requests for unexpected external script loads. Use WordPress security plugins with malware scanning capabilities to detect stored payloads. If available, check backups to determine when the injection occurred.

Why prioritize this

This vulnerability warrants immediate attention due to its HIGH CVSS score, lack of authentication requirements, and ability to compromise all users accessing affected pages. Stored XSS is particularly dangerous because the attack persists and scales automatically—every visitor becomes a potential victim without requiring individual exploitation steps. Given the ubiquity of WordPress and popularity of filtering plugins, this attack surface is likely targeted by automated scanners.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects the combination of network-based attack vector (AV:N), low attack complexity (AC:L), no privilege or authentication required (PR:N, UI:N), changed scope (S:C), and limited impact on confidentiality and integrity (C:L, I:L) with no availability impact (A:N). The score is elevated by the changed scope: while an attacker cannot directly access the server or database, they can compromise the confidentiality and integrity of visitor sessions and data. The absence of availability impact reflects that the attack does not crash or degrade the site itself.

Frequently asked questions