CVE-2026-81825

HighCVSS 7.2

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

The Simple Ajax Chat plugin for WordPress (versions up to and including <= 20260811) is vulnerable to Stored Cross-Site Scripting via chat messages due to insufficient input sanitization and output escaping. The nonce protecting chat message submission is publicly visible on the chat page, allowing unauthenticated attackers to persistently inject malicious scripts.

Risk Assessment

An unauthenticated attacker can inject malicious scripts that execute for every visitor of the chat page, potentially leading to session theft or other attacks.

Recommendation

Update the plugin to a version newer than 20260811 or disable it if no fix is available.

Other vulnerabilities in Simple Ajax Chat

CVE-2026-81807High
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

Original NVD description (English source)

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS