CVE-2026-81807

HighCVSS 8.8

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

Risk Assessment

The risk includes the execution of malicious scripts in the administrator's browser, which could lead to session hijacking or site compromise.

Recommendation

Update the plugin to the latest version and consider restricting access to the chat or moderating content.

Other vulnerabilities in Simple Ajax Chat

CVE-2026-81825High
The Simple Ajax Chat plugin for WordPress (versions up to and including <= 20260811) is vulnerable to Stored Cross-Site Scripting via chat messages due to insufficient input sanitization and output escaping. The nonce protecting chat message submission is publicly visible on the chat page, allowing unauthenticated attackers to persistently inject malicious scripts.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS