EUVD-2026-69859
GHSA-xx7f-q66c-932r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Scope changes from plugin to WordPress admin context enabling full account takeover; no direct availability impact from XSS alone.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.
AnalysisAI
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Simple Ajax Chat plugin must be installed and active on the WordPress site, and the chat widget must be reachable by unauthenticated users (the default configuration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) with High across C/I/A places this firmly in high-priority territory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Simple Ajax Chat to version 20260827 or later immediately; this is the vendor-released patch that introduces proper output escaping on chat message content. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using Simple Ajax Chat and verify which are running vulnerable versions prior to 20260827. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Simple Ajax Chat
View allSensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115. Rated high severit
The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using th
The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could all
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malici
Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the cha
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today