CyberRota Analysis
AI-GeneratedThe Simple Ajax Chat plugin for WordPress prior to version 20260827 is vulnerable due to improper escaping of chat message content, enabling unauthenticated users to inject arbitrary HTML and execute scripts in the browsers of all users, including administrators. This flaw poses a significant risk of cross-site scripting (XSS) attacks, which can lead to data theft or site compromise. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.
Original NVD Description
The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.