CVE-2026-81807: Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
Published Sep 2, 2026
·Updated
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.
Affected Software
1 affected component
WordPress plugin: Simple Ajax Chat<20260827
Event History
Sep 2, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can exploit this issue, and who is at risk from the injected script?
An unauthenticated user can submit a crafted chat message. Scripts can execute in the browser of anyone who views the chat, including WordPress administrators.
2
What should be checked to determine whether the site is affected?
Check the installed Simple Ajax Chat plugin version. Versions before 20260827 are affected.
3
What is the immediate mitigation if updating is not possible?
The provided information identifies chat message submission as the attack path. Restricting or disabling access to the chat until the plugin can be updated reduces exposure.