CVE-2026-81825

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress, in all versions up to and including 20260811, is vulnerable to stored cross-site scripting (CWE-79) because chat message input is insufficiently sanitized and output is insufficiently escaped. The nonce that should gate message submission is publicly visible on the chat page, so it provides no real barrier, allowing fully unauthenticated attackers to submit messages containing arbitrary web scripts. These malicious messages are stored persistently and execute in the browser of every visitor who loads the affected page, potentially enabling session hijacking, credential theft, or content/redirect manipulation against admins and regular users alike. Any WordPress site running an affected version of the plugin is exposed, and the high-severity scope-changed CVSS score (7.2) reflects that impact on users beyond the vulnerable component. As of disclosure there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

What to do: Update Simple Ajax Chat to the latest patched release (any version newer than 20260811) via the WordPress plugin admin as soon as one is available. Until patched, consider temporarily deactivating the plugin or limiting chat posting to trusted users, and review stored chat messages for injected HTML/JavaScript. If an attacker-controlled message was rendered while an admin was logged in, check sessions and rotate credentials as a precaution.