High severity · published Sep 2, 2026
CVE-2026-81807
Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Simple Ajax Chat ·
before 20260827 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81807
wpscan.com
https://wpscan.com/vulnerability/7aceefd5-aa09-4828-b375-6a62997fa0c2/
More from Simple Ajax Chat
7.1
CVE-2024-1983
Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS
5.4
CVE-2024-2470
Simple Ajax Chat < 20240412 - Admin+ Stored XSS