What’s Vulnerable › Vulnerabilities

CVE-2024-1983: Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-20 · updated 2026-06-17

Description

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.

Affected products

• Jeff Starr Simple Ajax Chat (WordPress plugin): before 20240223 — fixed in 20240223

How to fix

Upgrade to a fixed version: Jeff Starr Simple Ajax Chat (WordPress plugin) 20240223. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/
• https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/

Get alerted when CVE-2024-1983 or the next vulnerability affects your stack