PT-2026-84639 · WordPress · Simple Ajax Chat
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Simple Ajax Chat versions prior to 20260827
Description
Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape chat message content before rendering it. This allows unauthenticated users to inject arbitrary HTML attributes into the page and execute scripts in the browser of any user viewing the chat, including administrators.
Recommendations
Update Simple Ajax Chat to version 20260827 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simple Ajax Chat