CVE-2026-2987 describes a stored cross-site scripting vulnerability in the Simple Ajax Chat plugin for WordPress, specifically via the 'c' parameter. The vulnerability arises from insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects versions up to and including 20260217. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, which can lead to the execution of arbitrary scripts in the context of other users. This may result in partial confidentiality and integrity impacts, such as theft of user credentials or manipulation of displayed content. There is no impact on availability reported. No known exploits are currently documented in the wild.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the plugin or restricting access to affected functionality to trusted users only. Monitor official vendor channels for updates and apply patches promptly once available.