CVE-2024-2470: Simple Ajax Chat < 20240412 - Admin+ Stored XSS
The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2470?
The severity of CVE-2024-2470 is considered critical due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2024-2470?
To fix CVE-2024-2470, update the Simple Ajax Chat plugin to version 20240412 or later.
Who is affected by CVE-2024-2470?
CVE-2024-2470 affects users with high privileges, such as admins, who use versions of the Simple Ajax Chat plugin before 20240412.
What kind of attacks can CVE-2024-2470 enable?
CVE-2024-2470 can enable stored cross-site scripting (XSS) attacks on affected WordPress installations.
Is user input affected by CVE-2024-2470?
Yes, CVE-2024-2470 is caused by the lack of sanitization and escaping of user input within the plugin.