Simple Ajax Chat CVE-2026-81807

The Simple Ajax Chat plugin must be installed and active on the WordPress site, and the chat widget must be reachable by unauthenticated users (the default configuration). No account, API key, or special permission is required to post a chat message. Exploitation completes when any user with a valid browser session - most critically a logged-in WordPress administrator - views the page rendering the chat. The only limiting factor is that an admin or privileged user must view the chat after the malicious message is posted (UI:R); automated exploitation of a specific admin session is not possible without this interaction.

CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) with High across C/I/A places this firmly in high-priority territory. The no-authentication requirement (PR:N) and low complexity (AC:L) mean any remote user can plant the payload without prior account registration. The sole friction is UI:R - a human must view the chat - but on a live-chat plugin this is nearly guaranteed, especially for administrators who monitor conversations. A publicly available exploit (sourced from WPScan) reduces any remaining exploitation barrier to near-zero. No KEV listing is present, so confirmed mass exploitation is not established, but the combination of zero-barrier posting, high-value admin targets, and public PoC makes real-world abuse highly plausible. The CVSS A:H component is arguably overstated for pure XSS absent scope change; realistic impact is session hijack and full WordPress admin compromise (C:H/I:H). EPSS data was not provided; given the public PoC and WordPress-ecosystem attack surface, actual exploitation probability is likely non-trivial.

An unauthenticated attacker submits a chat message containing a JavaScript payload - for example, a script tag that exfiltrates document.cookie to an attacker-controlled server - to the publicly visible chat widget. The message is stored and rendered without escaping to every subsequent visitor. When a WordPress administrator views the chat page, their session cookie is silently transmitted to the attacker, who then uses it to log in with full administrative privileges and achieve complete site compromise. A public proof-of-concept demonstrating this technique is available via WPScan.