Simple Ajax Chat < 20260827 – Unauthenticated Stored XSS via Chat Message Linkification | CVE 2026-81807

Description

The plugin does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

Proof of Concept

Prerequisites: Simple Ajax Chat is active with its default settings and a published page carries the [sac_happens] shortcode, or the simple_ajax_chat() template tag, which is the plugin's normal front end. No configuration change is needed and the attacker needs no account.

1. As an unauthenticated visitor, open the page carrying the chat and read the value of the sac_nonce hidden field from the chat form.

2. Post a chat message whose text is a URL followed immediately by a double quote and the attributes to inject, with no space anywhere in it:

http://a.co/"autofocus/onfocus="alert(document.domain)

Either by typing it into the chat form's Message box and pressing Submit, or directly:

curl -X POST "https://victim.example/wp-content/plugins/simple-ajax-chat/simple-ajax-chat-core.php" --data-urlencode "sac_name=Attacker" --data-urlencode 'sac_chat=http://a.co/"autofocus/onfocus="alert(document.domain)' --data-urlencode "sac_no_js=true" --data-urlencode "sac_verify=" --data-urlencode "sac_nonce=<value read in step 1>"

3. Load the page carrying the chat. The plugin turns the message into a link and copies the whole matched string, quote included, into the link's href attribute, so the quote closes it early and what follows becomes live attributes on the element:

<a rel="external nofollow" href="http://a.co/"autofocus/onfocus="alert(document.domain)" title="Open link in new tab">

The browser parses this as href="http://a.co/" followed by autofocus and onfocus="alert(document.domain)". The script runs on page load, with no click and no hover, in the browser of every visitor who loads the page, including an administrator browsing the site while logged in.

The same payload also reaches the same place through the plugin's AJAX submission route, whose secondary token is one of ten values hardcoded in the plugin's own source.