Skip to content
Sign in
5.4 Medium

CVE-2024-2470 The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could…

Description

The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products and versions

Product Affected versions Fixed in
simple_ajax_chat 20240412 earliest → < 20240412 20240412
Simple Ajax Chat 20240412 earliest → < 20240412 20240412

Other CVEs of simple_ajax_chat

The 2 CVEs of simple_ajax_chat →
CVE-2024-1983 The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using… 7.1 High
Track this CVE