WordPress Plugin Vulnerabilities

Simple Ajax Chat < 20260301 - Unauthenticated Stored Cross-Site Scripting via 'c'

Description

The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
simple-ajax-chat
Fixed in 20260301

References

CVE
CVE-2026-2987
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3c07dec6-ddb7-45df-8bdf-57f562102c4b

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Kazuma Matsumoto
Verified
No
WPVDB ID
3d77c9c7-2b6b-45cc-9f6d-c8cf6e47558b

Timeline

Publicly Published
2026-03-12 (about 2 months ago)
Added
2026-03-12 (about 2 months ago)
Last Updated
2026-03-12 (about 2 months ago)

Other

Published
Title
Published
2017-04-26
Title
Avada Theme <= 5.1.4 - Stored Cross-Site Scripting (XSS) & CSRF
Published
2024-01-05
Title
Oxygen Builder < 4.8.1 - Contributor+ Stored XSS
Published
2024-10-10
Title
WP Ultimate Post Grid < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode
Published
2024-07-19
Title
Gutenverse < 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-07-05
Title
Easy Custom Code (LESS/CSS/JS) – Live editing < 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting