Auto Infinite Scroll security review
Security › Auto Infinite Scroll
Security score 100/100 · Version 1.74.8 · Reviewed 2 November 2026 · Source fingerprint 64734e8
Summary
We reviewed Auto Infinite Scroll 1.74.8 on 2 November 2026, and it scored 100/100 for security. The review was carried out by an AI agent working through our written security checklist. It read every first-party PHP and JavaScript file in the plugin and the shared settings library’s AI, installer, licence and update code. It ran seven times that day, each time on the latest fixed version, and the scores were 50, 75, 90, 75, 75, 75 and 100 as each round looked further. Each finding was reproduced on a private test site, including a real multisite network, and each fix was confirmed with a test that failed before the change and passes after it.
What was found and fixed
Each review round numbered its own findings from SECURITY-001, so the IDs below give the round and the version reviewed.
- Round 1 (1.74.2) SECURITY-001, Critical, 25 points. The infinite scroll loader took the first “next page” link anywhere on the page and inserted the HTML it fetched. An Author could place a link and a matching container class in a post, point the link at their own server, and have script run for every visitor who scrolled the post, administrators included. Fix: the loader refuses next-page links on another website. Fixed in: 1.74.3, completed by the round 2 and 3 fixes below.
- Round 1 (1.74.2) SECURITY-002, High, 25 points. The settings page printed saved values into form fields without escaping. The AI agent account, which is deliberately given less power than an administrator, could save a value that ran script when an administrator opened the settings page. Fix: every settings value is escaped where it is printed. Fixed in: 1.74.3.
- Round 2 (1.74.3) SECURITY-001, Critical, 25 points. The loader still trusted any response from the site itself. An Author could upload a text file containing HTML, or link a WordPress REST address that answers with JavaScript, and get the same result as round 1. Fix: the loader fetches next pages as HTML only, never runs a script response, and accepts only responses whose content type is an HTML page. Fixed in: 1.74.4.
- Round 3 (1.74.4) SECURITY-001, Medium, 10 points. The website check was made on the link, not on the address the browser finally loaded. On a site that also has an open redirect from another plugin, an Author’s link could still lead to another website. Fix: the loader also checks the final address after any redirect. Fixed in: 1.74.5.
- Round 4 (1.74.5) SECURITY-001, Medium, 25 points. The
inspect-archiveAI ability compared only the hostname of the address it was asked to inspect, not the scheme or port, and it followed redirects. The AI agent account could make the server request other ports on its own hostname, and addresses reached through a redirect, and read back page titles. Fix: the ability inspects only pages on the site’s own scheme, host and port, does not follow redirects, and reports a generic error when a fetch fails. Fixed in: 1.74.6. - Round 5 (1.74.6) SECURITY-001, Critical, 25 points. On multisite, a sub-site administrator is not allowed to add script, but the four CSS selector settings were saved without cleaning, and the front end passes them to jQuery, which builds HTML from a value that starts with a tag. A sub-site administrator could run script for the network super administrator and every visitor to that sub-site. Single-site installs were not affected. Fix: selector settings are saved as plain text, and any stored value containing markup is ignored. Fixed in: 1.74.7.
- Round 6 (1.74.7) SECURITY-001, Medium, 25 points. In the shared settings library, the AI connection set-up created its agent user without checking that the person setting it up may add users. On multisite, where the network can stop sub-site administrators adding users, a sub-site administrator could create one. Fix: creating the agent user now needs permission to add users. Fixed in: 1.74.8 (shared library 1.14.5).
The 90/100 published on 4 September 2026 reflected one finding in the shared licensing and update library that all our paid plugins carry:
- Licence key in update URLs, Medium, 10 points. Update downloads included the licence key in the download URL, where web servers, proxies and WordPress’s own update records could store it. Fix: the licence key is now sent in a request header that goes only to our update server, with redirects turned off. Fixed in: 1.74.2 (shared library 1.14.3). Version 1.74.8 also includes shared library 1.14.5, which no longer includes a developer build script from the bundled update checker.
What the review covered
| Area | Result | Evidence |
|---|---|---|
| Authentication, authorisation, ownership and request forgery | Checked | All 11 entry points were traced, including every handler that relies on manage_options, checked from a multisite sub-site administrator’s position. The settings form uses WordPress’s nonce and manage_options, the AI abilities need ais_manage, and the shared ajax handlers check capability and nonce. User creation now needs create_users. |
| SQL injection | Not applicable | The plugin’s own code runs no database queries. The shared library’s single update uses fixed values and formats. |
| Cross-site scripting | Checked | The loader accepts only HTML pages from the same site whose final address is also on the same site, and never runs a script response. Settings values are escaped, and selector markup is refused on save and ignored if already stored. The shared settings output is escaped. The bundled History.js was read. |
| Server-side request forgery, open redirects and header injection | Checked | inspect-archive fetches only the site’s own origin, without redirects, and returns generic errors. The shared plugin installer takes packages from an allow-list of origins and checks every redirect. |
| File uploads and path traversal | Checked | The plugin handles no uploads or files. The shared installer writes only to a WordPress temporary file. |
| Remote code execution and unsafe deserialisation | Checked | No unserialize or evaluation of input. Installing plugins needs super administrator rights on multisite, install_plugins on a single site, and explicit confirmation. |
| XML parsing | Checked | inspect-archive uses the HTML parser, and its XPath queries are built only from safe characters. |
| Secrets, privacy and data exposure | Checked | The licence key travels only in a header to the exact update download address, and is hidden from AI agents. |
| Business logic, replay and concurrency | Checked | The AI update-config ability checks every value before writing any. The cost of the keep-scripts patterns is bounded by PHP’s regular-expression limits, and only settings holders can write them. |
| Dependencies | Checked | Shared settings library 1.14.5. The bundled MCP Adapter 0.5.0 and php-mcp-schema 0.1.3 have no known advisories. |
| JWT, GraphQL and server-side templates | Not applicable | The plugin uses none of these. |
Not scored
Nothing was left unverified in the final review.
