What’s Vulnerable › Vulnerabilities
CVE-2026-81807: Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-03
- Weakness: CWE-79
Description
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.
Affected products
- Jeff Starr Simple Ajax Chat (WordPress plugin): before 20260827 — fixed in 20260827
How to fix
Upgrade to a fixed version: Jeff Starr Simple Ajax Chat (WordPress plugin) 20260827. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81807 or the next vulnerability affects your stack