Executive brief
The Simple Ajax Chat WordPress plugin provides a chat feature on websites. The plugin fails to properly sanitize and escape chat messages, allowing unauthenticated attackers to inject malicious scripts that are stored in the database and executed in the browsers of all visitors. Since the nonce protecting message submission is publicly visible, anyone can submit messages without authentication, making this a direct path for attackers to inject persistent malware or phishing content into the site.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Ajax Chat plugin caused by insufficient input sanitization and output escaping on chat messages. The vulnerability is network-reachable and requires no authentication; the nonce token protecting chat submission is publicly exposed in the page HTML, rendering it ineffective. Unauthenticated attackers can inject arbitrary JavaScript via the chat message form, which is then stored in the database and reflected to all site visitors on page load. The injected scripts execute in the context of the affected pages, potentially allowing session hijacking, credential theft, malware distribution, or defacement. Patches addressing this issue should sanitize user input and properly escape output when rendering chat messages.
Affected products
- WordPress.org Simple Ajax Chat up to and including 20260811
Timeline
- 2026-09-11: disclosed