WP Manifestindependent plugin directory
manifest / content / auto-load-next-post

Auto Load Next Post WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Increase the pageviews on your WordPress site and reduce bounce rates as readers continue reading your posts infinitely scrolling down the page.

by Sébastien Dumont · github.com/autoloadnextpost/auto-load-next-post · website

★ 60stars
v1.5.14latest · 7 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/autoloadnextpost/auto-load-next-post/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/autoloadnextpost/auto-load-next-post ↗

Auto Load Next Post, Infinite post scroll for WordPress

Welcome to the Auto Load Next Post repository on GitHub. Here you can browse the source code, look at open issues and keep track of development. I recommend all developers to follow the blog to stay up to date about everything happening in the project or simply view the public roadmap.

If you are not a developer, please use the Auto Load Next Post plugin page to download the latest release from WordPress.org.

Want to contribute to the project? Then please read the contribute guidelines clearly.

🔔 What is Auto Load Next Post?

Auto Load Next Post is a WordPress plugin developed to increase your pageviews by engaging the site viewers to keep reading your content rather than increasing your bounce rate.

It simply automatically loads the next post on your blog once the user has reached the bottom of the initial post the viewer is reading and repeats the process as the user reads your content until there are no more posts to load.

✅ Features

  • Customizable repeater template
  • jQuery event triggers plus 3rd-party support
  • Reduce page load by hiding the post comments
  • Track pageviews with Google Analytics. Requires Google Analytics to be applied on your site first for this to work.
  • Developer friendly
  • Works with any theme or framework, even child-themes
  • WordPress Network / Multisite Supported

Want more? See what is coming soon with Auto Load Next Post Pro.

📘 Guide

📖 Documentation

Documentation for Auto Load Next Post is available at: https://github.com/autoloadnextpost/alnp-documentation

If you would like to help translate the documentation in another language then all you have to do is follow the contribution instructions.

💽 Installation

You may:

  1. Clone the GitHub repository: https://github.com/autoloadnextpost/auto-load-next-post.git, or..
  2. Download the latest release from the GitHub repository, or..
  3. Download the plugin from the WordPress repository.
  4. Go to WordPress Admin > Plugins > Add New.
  5. Click Upload Plugin at the top.
  6. Choose File and select the .zip file you downloaded in Step 1,2 or 3.
  7. Click Install Now and Activate the Auto Load Next Post.

If you also want to test out beta releases, you can download the beta tester plugin which will replace your installed version of Auto Load Next Post with the latest tagged pre-release on GitHub.

Note to Beginners

Auto Load Next Post is a plugin for self-hosted WordPress sites. This means you will need to switch from WordPress.com to WordPress.org if you want to use this plugin on your WordPress site.

🐛 Found a Bug?

If you find a bug within Auto Load Next Post, please report the issue by creating a ticket on the GitHub repository where I can deal with it more appropriately. Please ensure that you read the guidelines for contributing prior to submitting your report. To help me solve the issue, please be as descriptive as possible.

⭐ Support

Need help? This is a developer's portal for Auto Load Next Post and should not be used for general support. Please visit the support forum on WordPress.org if you need help.

🦄 Contributions

Anyone is welcome to contribute to Auto Load Next Post. If you have a patch, or stumbled upon an issue with Auto Load Next Post, please read the guidelines for contributing to this repository.

There are various ways you can contribute:

  1. Raise an Issue on GitHub
  2. Send a pull request with your bug fixes and/or new features
  3. Provide feedback and suggestions on enhancements

👅 Translation Support

Auto Load Next Post is in need of translations. Is the plugin not translated in your language or do you spot errors with the current translations? Helping out is easy! Translate Auto Load Next Post.

📚 Libraries Used

The libraries above are used with the plugin.

👍 Contribute

If you or your company use Auto Load Next Post or appreciate the work I’m doing in open source, please consider supporting me directly so I can continue maintaining it and keep evolving the project.

You'll be helping to ensure I can spend the time not just fixing bugs, adding features or releasing new versions but also keeping the project afloat. Any contribution you make is a big help and is greatly appreciated.

Please also consider starring ✨ and sharing 👍 the project repository! This helps the project getting known and grow with the community. 🙏

I accept one-time donations and monthly via BuyMeACoffee.com

  • My PayPal
  • BuyMeACoffee.com
  • Bitcoin (BTC): 3L4cU7VJsXBFckstfJdP2moaNhTHzVDkKQ
  • Ethereum (ETH): 0xc6a3C18cf11f5307bFa11F8BCBD51F355b6431cB
  • Litecoin (LTC): MNNy3xBK8sM8t1YUA2iAwdi9wRvZp9yRoi
License

Auto Load Next Post is released under GNU General Public License v3.0.

Credits

Auto Load Next Post is developed and maintained by Sébastien Dumont.

Releases

Newest 25 of 37 recorded releases.

Tag
Published
v1.5.14 latest
Sep 16, 2019 7 years ago
v1.6.0-beta.1
Sep 6, 2019 7 years ago
v1.5.13
Sep 5, 2019 7 years ago
v1.5.12
Apr 23, 2019 7 years ago
v1.5.11
Apr 10, 2019 7 years ago
v1.5.10
Apr 5, 2019 7 years ago
v1.5.9
Apr 5, 2019 7 years ago
v1.5.8
Apr 1, 2019 7 years ago
v1.5.7
Mar 25, 2019 7 years ago
v1.5.6
Mar 13, 2019 7 years ago
v1.5.5
Nov 28, 2018 7 years ago
v1.5.4
Nov 10, 2018 7 years ago
v1.5.3
Sep 15, 2018 8 years ago
v1.5.2
Sep 14, 2018 8 years ago
v1.5.1
Sep 14, 2018 8 years ago
v1.5.0
Sep 14, 2018 8 years ago
v1.5.0-beta.3
Aug 24, 2018 8 years ago
v1.4.13
Aug 24, 2018 8 years ago
v1.5.0-beta.2
Aug 17, 2018 8 years ago
v1.5.0-beta.1
Aug 6, 2018 8 years ago
v1.4.12
May 19, 2018 8 years ago
v1.4.11
Apr 23, 2018 8 years ago
v1.4.10
Apr 21, 2018 8 years ago
v1.4.10-beta.3
Apr 16, 2018 8 years ago
v1.4.10-beta.2
Apr 16, 2018 8 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Auto Load Next Post 1.5.14 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.5.14
Findings
2
Worst severity
high
Content hash
e3273e9d1612607939bfd9e7…

Findings

  • high Stored DOM XSS: post title is concatenated into HTML by the infinite-scroll script

    xss_stored

    On singular posts the plugin enqueues assets/js/frontend/auto-load-next-post.min.js (readable source: auto-load-next-post.js) and localizes auto_load_next_post_params. run_alnp() builds a divider with string concatenation: jQuery(content_container).prepend('<hr ... data-title="' + post_title + '" data-url="' + orig_curr_url + '"/>') where post_title is window.document.title. WordPress puts the raw post_title into the document title (escaped only at <title> output via esc_html); the DOM property is the decoded string. An Author can publish a post titled e.g. foo"><img src=x onerror=alert(document.domain)> (Contributor can stage the same for an editor to publish). jQuery.prepend parses the string as HTML, so the injected <img onerror> / event-handler attributes execute for every visitor of that post, including administrators (session/nonce theft). wp_localize_script JSON-encoding of selectors is unrelated — this sink is HTML concatenation, not a JSON consumer. Location.href is typically percent-encoded so the data-url half is not a practical reflected vector; the stored title is.

    assets/js/frontend/auto-load-next-post.js:1-21,79

    Recommendation

    Never concatenate document.title or location.href into HTML. Create the hr with document.createElement / jQuery and set data-title/data-url via .attr() (or dataset), which attribute-encodes. Keep the same pattern for the later post_divider built from post_url.

  • medium CSRF: GET reset-alnp=yes wipes all plugin options with no nonce (CVE-2025-30529)

    csrf

    Auto_Load_Next_Post_Install hooks reset_alnp to init (priority 0). The handler fires on any front- or back-end request when the current user can install_plugins and $_GET['reset-alnp']=='yes'. There is no wp_verify_nonce/check_admin_referer. On single-site it $wpdb->query-deletes every options row and usermeta key LIKE 'auto_load_next_post_%', then self::install() recreates defaults and flush_rewrite_rules(), then wp_safe_redirect to the settings page. The Misc settings 'Reset' button is a GET link (type=button url=options-general.php?...&reset-alnp=yes) with only a JS onbeforeunload confirm. An unauthenticated attacker who tricks an administrator into opening https://site/?reset-alnp=yes (SameSite=Lax still sends cookies on a top-level GET navigation) resets theme selectors, event hooks, uninstall flag, and related usermeta. This is CVE-2025-30529 (CVSS 4.3); Wordfence/Patchstack list no official patch and 1.5.14 is still the latest tag. Not rated high: blast is plugin options/usermeta, not roles, files, or payment settings. Settings save itself is nonce-gated and is not this bug.

    includes/class-alnp-install.php:39-40,244-278

    Recommendation

    Require check_admin_referer (or wp_verify_nonce) for a dedicated reset action, keep the install_plugins/manage_options gate, and switch the Reset control to a POST form. Do not honor reset-alnp on arbitrary front-end URLs. After a successful reset, redirect with a one-time admin notice rather than a replayable GET.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →