Connekthq develops a focused line of WordPress plugins centered around image handling and content loading, including Ajax Load More and Instant Images, which sit in the content-delivery and upload layer of many WordPress installations. The vendor's vulnerability profile recurs through input-handling and deserialization weaknesses characteristic of web-facing plugins, including cross-site scripting variants, path traversal, missing authorization checks, and untrusted deserialization, alongside a moderate tendency toward public exploit availability. Defenders should treat WordPress plugin updates from this vendor as a patching priority given the plugins' broad deployment and the recurring input-validation exposures; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Connekthq over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-10140HIGH The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitra | Jul 22, 2025 | 8.8 | 39 | NO | YES |
CVE-2023-27451HIGH Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions. | Nov 22, 2023 | 8.8 | 24 | NO | NO |
CVE-2021-24140HIGH Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test | Mar 18, 2021 | 7.2 | 23 | NO | NO |
CVE-2022-2433HIGH The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, | Sep 6, 2022 | 8.8 | 22 | NO | NO |
CVE-2024-0869MEDIUM The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insu | Feb 5, 2024 | 6.5 | 20 | NO | NO |
CVE-2022-4466MEDIUM The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sho | Mar 13, 2023 | 5.4 | 19 | NO | NO |
CVE-2022-2943MEDIUM The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path va | Sep 6, 2022 | 4.9 | 19 | NO | NO |
CVE-2021-24334MEDIUM The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter set | Jun 1, 2021 | 5.4 | 19 | NO | NO |
CVE-2024-8505MEDIUM The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and includi | Oct 2, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-4711MEDIUM The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions up to, and including, | Jun 1, 2024 | 5.4 | 17 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Connekthq.
Media articles that mention a CVE ID that affects a product developed by Connekthq — matched by CVE ID, not by vendor name.