CVE-2015-4465

Zanematthew ZM Ajax Login & Register < 1.0.9 - XSS

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-4465. PoCs published by Panagiotis Vagenas.

AI-analyzed exploit summary This is a writeup describing a Local File Inclusion (LFI) vulnerability in the WordPress zM Ajax Login & Register plugin. The exploit leverages the `wp_ajax_nopriv_load_template` action to include arbitrary local files via the `template` POST parameter without validation.

Description

Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploits (1)

exploitdb WRITEUP
by Panagiotis Vagenas · textwebappsphp
https://www.exploit-db.com/exploits/37200

This is a writeup describing a Local File Inclusion (LFI) vulnerability in the WordPress zM Ajax Login & Register plugin. The exploit leverages the `wp_ajax_nopriv_load_template` action to include arbitrary local files via the `template` POST parameter without validation.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: WordPress zM Ajax Login & Register Plugin 1.0.9
No auth needed
Prerequisites: Access to the target WordPress site · Knowledge of the plugin's installation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

EPSS 0.0421
EPSS Percentile 89.7%

Details

CWE
CWE-79
Status published
Products (1)
zanematthew/zm_ajax_login_\&_register < 1.0.9
Published Jun 10, 2015
Tracked Since Feb 18, 2026