Skip to content
Sign in
8.8 High

CVE-2026-81807 The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it,…

Description

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

Affected products and versions

Product Affected versions Fixed in
Simple Ajax Chat 20260827 earliest → < 20260827 20260827

Other CVEs of Simple Ajax Chat

The 3 CVEs of Simple Ajax Chat →
CVE-2024-2470 The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could… 5.4 Medium CVE-2024-1983 The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using… 7.1 High
Track this CVE