Vulnerability · Published Jan 31, 2026 · Assigned by Wordfence

CVE-2025-15525Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure

Medium 5.3

In plain English

A medium-severity incorrect authorization in Ajax Load More – Infinite Scroll, Load More, & Lazy Load from dcooney. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.

Affected products (as reported)

Vendor	Product	Versions
dcooney	Ajax Load More – Infinite Scroll, Load More, & Lazy Load	0 – through 7.8.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References