CVE-2026-81807 — Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

CVE-2026-81807

Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification PUBLISHED

Description (CNA)

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / Simple Ajax Chat	affected 0 before 20260827

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7aceefd5-aa09-4828-b375-6a62997fa0c2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.