CVE-2026-81807
Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.
| Vendor | unknown |
| Product | simple ajax chat |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown simple ajax chat
Be the first to know when new high vulnerabilities affecting unknown simple ajax chat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Simple Ajax Chat
0 < 20260827
References
Credits
Erwan LR (WPScan) WPScan