Defined in 34 files
Last patched
ajax in wordpress-plugins/plugins was changed by 35 published CVE fixes between 2012 and 2026, in 35 distinct patches that added or removed 1,143 lines in total.
The name occurs in 34 files: sirv/trunk/plugdata/js/wp-options.js, gpt3-ai-content-generator/trunk/admin/js/chatbot.js, wpschoolpress/trunk/js/wpsp-student.js, wpschoolpress/trunk/js/wpsp-messages.js, woo-orders-tracking/trunk/assets/js/admin-edit-order.js, ai-scribe-the-chatgpt-powered-seo-content-creation-wizard/tags/2.6/assets/js/show_template.js, woo-orders-tracking/trunk/assets/js/admin-setting.js, woo-thank-you-page-nextmove-lite/trunk/admin/assets/js/xlwcty-admin-app.js, hive-support/trunk/backend/class-hive-support-admin.php, lastudio-element-kit/trunk/assets/js/lastudio-kit-base.js, wc-purchase-orders/trunk/public/js/wc-purchase-orders-public.js, acf-frontend-form-element/trunk/assets/js/frontend-admin.js, social-rocket/trunk/admin/js/admin.js, complianz-gdpr/trunk/DNSMPD/dnsmpd.js, login-with-ajax/trunk/login-with-ajax.php, ultimate-addons-for-contact-form-7/trunk/assets/js/admin-script.js, chamber-dashboard-business-directory/trunk/js/cdash_demo_content.js, woo-lucky-wheel/trunk/js/woocommerce-lucky-wheel.js, zephyr-project-manager/trunk/assets/js/core-admin.js, promolayer-popup-builder/trunk/includes/js/promolayer-admin.js, wpschoolpress/trunk/js/wpsp-notify.js, gsheetconnector-gravity-forms/trunk/assets/js/gfgs-connector.js, ultimate-addons-for-contact-form-7/trunk/addons/database/assets/js/database-pro-main.js, wpadverts/trunk/assets/js/block-details.js, cm-header-footer-script-loader/trunk/js/admin.js, waitlist-woocommerce/trunk/admin/assets/js/xoo-wl-admin-table-js.js, bdthemes-element-pack-lite/trunk/admin/assets/js/ep-notice.js, awesome-support/trunk/includes/rest-api/assets/admin/js/admin.js, wpadverts/trunk/assets/js/wpadverts-frontend.js, all-in-one-video-gallery/trunk/admin/assets/js/admin.js, qyrr-code/trunk/inc/freemius/templates/connect.php, woo-thank-you-page-nextmove-lite/trunk/xl/views/xl-deactivate-modal.phtml, post-smtp/trunk/script/postman.js, zephyr-project-manager/trunk/assets/js/zephyr-projects.js.
wordpress-plugins/plugins has 851 CVEs with a located fix in total, so 4% of them touched this function.
Every published CVE whose fix changed ajax, newest first, with the lines each fix touched.
CVE-2026-76931 · zephyr-project-manager/trunk/assets/js/core-admin.js · lines 4078–4079 · +2 −1
CVE-2026-76931 · zephyr-project-manager/trunk/assets/js/zephyr-projects.js · lines 1152–1154 · +3 −0
CVE-2026-6228 · acf-frontend-form-element/trunk/assets/js/frontend-admin.js · lines 999–4459 · +92 −2 in 2 hunks
CVE-2026-0703 · woo-thank-you-page-nextmove-lite/trunk/admin/assets/js/xlwcty-admin-app.js · lines 186–313 · +19 −19 in 4 hunks
CVE-2025-14947 · all-in-one-video-gallery/trunk/admin/assets/js/admin.js · line 373 · +1 −0
CVE-2025-14509 · woo-lucky-wheel/trunk/js/woocommerce-lucky-wheel.js · line 153 · +1 −0
CVE-2025-11981 · wpschoolpress/trunk/js/wpsp-messages.js · lines 77–311 · +53 −25 in 7 hunks
CVE-2025-11981 · wpschoolpress/trunk/js/wpsp-notify.js · lines 132–133 · +2 −2
CVE-2025-11981 · wpschoolpress/trunk/js/wpsp-student.js · lines 266–641 · +46 −11 in 9 hunks
CVE-2025-8606 · gsheetconnector-gravity-forms/trunk/assets/js/gfgs-connector.js · lines 360–457 · +82 −77
CVE-2025-10000 · qyrr-code/trunk/inc/freemius/templates/connect.php · lines 1041–1050 · +5 −0
CVE-2025-9219 · post-smtp/trunk/script/postman.js · line 80 · +1 −4
CVE-2025-5391 · wc-purchase-orders/trunk/public/js/wc-purchase-orders-public.js · lines 29–50 · +4 −1 in 2 hunks
CVE-2025-6220 · ultimate-addons-for-contact-form-7/trunk/addons/database/assets/js/database-pro-main.js · lines 209–245 · +37 −2
CVE-2025-6220 · ultimate-addons-for-contact-form-7/trunk/assets/js/admin-script.js · lines 229–283 · +2 −2 in 2 hunks
CVE-2025-5018 · hive-support/trunk/backend/class-hive-support-admin.php · lines 961–1021 · +3 −3 in 3 hunks
CVE-2024-13567 · awesome-support/trunk/includes/rest-api/assets/admin/js/admin.js · lines 14–15 · +2 −2
CVE-2024-10860 · woo-thank-you-page-nextmove-lite/trunk/xl/views/xl-deactivate-modal.phtml · lines 138–173 · +24 −6
CVE-2025-0429 · gpt3-ai-content-generator/trunk/admin/js/chatbot.js · lines 2824–3139 · +16 −16 in 8 hunks
CVE-2025-0428 · gpt3-ai-content-generator/trunk/admin/js/chatbot.js · lines 2824–3139 · +16 −16 in 8 hunks
CVE-2024-13360 · gpt3-ai-content-generator/trunk/admin/js/chatbot.js · lines 2824–3139 · +16 −16 in 8 hunks
CVE-2024-11452 · chamber-dashboard-business-directory/trunk/js/cdash_demo_content.js · lines 1–53 · +53 −52
CVE-2024-12473 · ai-scribe-the-chatgpt-powered-seo-content-creation-wizard/tags/2.6/assets/js/show_template.js · lines 51–66 · +3 −3 in 2 hunks
CVE-2024-12606 · ai-scribe-the-chatgpt-powered-seo-content-creation-wizard/tags/2.6/assets/js/show_template.js · lines 51–66 · +3 −3 in 2 hunks
CVE-2024-12605 · ai-scribe-the-chatgpt-powered-seo-content-creation-wizard/tags/2.6/assets/js/show_template.js · lines 51–66 · +3 −3 in 2 hunks
CVE-2024-9702 · social-rocket/trunk/admin/js/admin.js · lines 2575–2576 · +2 −1
CVE-2024-9697 · social-rocket/trunk/admin/js/admin.js · lines 2575–2576 · +2 −1
CVE-2024-11202 · cm-header-footer-script-loader/trunk/js/admin.js · lines 1–62 · +62 −0
CVE-2024-10108 · wpadverts/trunk/assets/js/block-details.js · lines 27–38 · +8 −0
CVE-2024-10108 · wpadverts/trunk/assets/js/wpadverts-frontend.js · lines 117–121 · +2 −2
CVE-2024-8964 · sirv/trunk/plugdata/js/wp-options.js · lines 745–746 · +2 −0
CVE-2024-8480 · sirv/trunk/plugdata/js/wp-options.js · lines 391–2600 · +92 −32 in 33 hunks
CVE-2024-3602 · promolayer-popup-builder/trunk/includes/js/promolayer-admin.js · lines 1–83 · +83 −0
CVE-2024-5324 · waitlist-woocommerce/trunk/admin/assets/js/xoo-wl-admin-table-js.js · lines 63–64 · +2 −1
CVE-2024-4431 · lastudio-element-kit/trunk/assets/js/lastudio-kit-base.js · lines 282–515 · +5 −1 in 2 hunks
CVE-2024-3927 · bdthemes-element-pack-lite/trunk/admin/assets/js/ep-notice.js · lines 1–18 · +18 −18
CVE-2022-0193 · complianz-gdpr/trunk/DNSMPD/dnsmpd.js · lines 10–27 · +7 −1 in 2 hunks
CVE-2021-25062 · woo-orders-tracking/trunk/assets/js/admin-edit-order.js · lines 75–406 · +16 −16 in 7 hunks
CVE-2021-25062 · woo-orders-tracking/trunk/assets/js/admin-setting.js · lines 173–512 · +5 −5 in 5 hunks
CVE-2012-4283 · login-with-ajax/trunk/login-with-ajax.php · line 166 · +1 −1
CVE-2012-2759 · login-with-ajax/trunk/login-with-ajax.php · line 166 · +1 −1
Get an alert when the next CVE fix lands in wordpress-plugins/plugins, with the patched functions.
Monitor plugins CVEsFunctions in the same files that CVE fixes also changed.
Functions in wordpress-plugins/plugins changed by the most CVE fixes.
Common questions about CVE fixes to ajax.
Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.
Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.
