CVE-2024-8505
📋 TL;DR
This stored XSS vulnerability in the WordPress Infinite Scroll plugin allows authenticated attackers with Contributor access or higher to inject malicious scripts into website pages. When users visit compromised pages, the scripts execute in their browsers, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 7.1.2 are affected.
💻 Affected Systems
- WordPress Infinite Scroll – Ajax Load More plugin
📦 What is this software?
Ajax Load More by Connekthq
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor accounts inject malicious scripts to steal user session cookies or credentials, potentially compromising user accounts.
If Mitigated
With proper input validation and output escaping, the vulnerability is prevented, and only trusted users can modify plugin settings.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has contributor privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.3 or later
Vendor Advisory: https://wordpress.org/plugins/ajax-load-more/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Ajax Load More' and click 'Update Now'. 4. Verify the plugin version is 7.1.3 or higher.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Ajax Load More plugin until patched
wp plugin deactivate ajax-load-more
Restrict user roles
allLimit contributor-level access to trusted users only
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in 'button_label' parameter
- Apply strict Content Security Policy (CSP) headers to limit script execution
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Ajax Load More version 7.1.2 or lowerCheck Version:
wp plugin get ajax-load-more --field=versionVerify Fix Applied:
Confirm plugin version is 7.1.3 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin with 'button_label' parameter containing script tags
- Multiple failed login attempts followed by successful contributor login
Network Indicators:
- HTTP requests with JavaScript payloads in button_label parameter
- Unexpected outbound connections from WordPress site
SIEM Query:
source="wordpress.log" AND "button_label" AND ("<script>" OR "javascript:")🔗 References
- https://plugins.trac.wordpress.org/browser/ajax-load-more/trunk/core/classes/class-alm-shortcode.php
- https://plugins.trac.wordpress.org/changeset/3160896/
- https://wordpress.org/plugins/ajax-load-more/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ca29158a-ca60-46c7-93a5-bcf76e7666e4?source=cve
