CVE-2026-81807

CVE-2026-81807 is a cross-site scripting flaw (CWE-79) in the Simple Ajax Chat WordPress plugin: versions before 20260827 render chat message content without escaping it. Any unauthenticated visitor can submit a chat message containing crafted HTML attributes, which are then injected into the page that displays the chat. Because the injected markup can include script-bearing attributes, an attacker can execute JavaScript in the browser of anyone viewing the chat, including site administrators, potentially enabling session hijacking or unintended administrative actions in their logged-in session. Any WordPress site running an unpatched version of the plugin is affected, and any such site that exposes the chat to unauthenticated visitors is directly triggerable. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.3%, so no confirmed exploitation is known at this time.

What to do: Update Simple Ajax Chat to version 20260827 or later, which escapes chat message content before rendering. If an immediate update is not possible, restrict or disable unauthenticated chat posting (or deactivate the plugin) until patched, since no privilege is required to trigger the flaw. Administrators who suspect abuse should review chat message logs for messages containing event-handler attributes or injected markup.