The Simple Ajax Chat plugin for WordPress is susceptible to a stored cross‑site scripting (XSS) flaw triggered by the 'c' parameter. Input supplied through this parameter is neither properly sanitized nor escaped before being saved and displayed. This allows an unauthenticated attacker to embed arbitrary JavaScript into chat message pages. When a user loads a page that contains the malicious content, the injected script runs in the context of the victim's browser, potentially exposing the site to web‑script attacks.

The vulnerability affects the Simple Ajax Chat plugin provided by specialk:Simple Ajax Chat – Add a Fast, Secure Chat Box. All releases up to and including version 20260217 are impacted. Users running any of these versions are at risk.

CVSS v3.1 score of 6.1 indicates a moderate severity with potential for widespread impact. EPSS score is reported as less than 1%, suggesting a low probability of real‑world exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an unauthenticated user to submit a request with a malicious 'c' parameter value to the plugin's endpoint; no authentication or special privileges are needed, but the attacker must be able to target the affected WordPress site.