The Simple Ajax Chat WordPress plugin releases before 20260827 fail to escape user‑supplied chat content before rendering it on the page. This omission permits any visitor to insert arbitrary HTML attributes or even full script tags into a chat message. When a page containing the unsanitized message is loaded, the inserted script executes in the context of the viewer’s browser, which may include privileged administrators or other users. The primary impact is the ability to steal session tokens, deface content, or perform other malicious actions on behalf of the victim.

This vulnerability affects the "Simple Ajax Chat" WordPress plugin, all installations using versions older than the 20260827 release. Administrators should verify the plugin version on their sites and upgrade if necessary.

The vulnerability is reachable by unauthenticated users who can post chat messages, and it can be immediately abused by injecting a crafted message. While no CVSS score is provided, the nature of stored XSS typically aligns with high severity. The EPSS score is not available, and the issue is not listed in CISA KEV, indicating no confirmed large‑scale exploitation. Nonetheless, the attack vector is straightforward: any visitor can exploit the chat; the impact is broad and can target both normal users and privileged administrators.