CVE-2026-81825: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in specialk Simple Ajax Chat – Add a Fast, Secure Chat Box
The Simple Ajax Chat plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability in all versions up to and including 20260811. This vulnerability allows unauthenticated attackers to inject malicious scripts via chat messages, which are then persistently stored and executed in the browsers of users who view the chat. The nonce intended to protect message submission is publicly visible, making it ineffective as an authentication barrier.
AI Analysis
Technical Summary
CVE-2026-81825 is a stored cross-site scripting vulnerability in the Simple Ajax Chat – Add a Fast, Secure Chat Box WordPress plugin. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts through chat messages. The nonce used for message submission is publicly visible on the chat page, allowing attackers to bypass authentication and submit malicious messages that persistently execute in users' browsers upon page load. This affects all versions up to and including 20260811.
Potential Impact
An attacker can execute arbitrary scripts in the context of users visiting pages with the injected chat messages. This can lead to information disclosure and integrity loss of user data. The vulnerability does not affect availability. The attack requires no authentication and can affect all visitors to the chat page.
Mitigation Recommendations
No patch or official fix is currently available. Users should monitor the vendor advisory for updates. Until a fix is released, consider disabling the plugin or restricting access to the chat feature to trusted users only to reduce exposure.
CVE-2026-81825: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in specialk Simple Ajax Chat – Add a Fast, Secure Chat Box
Description
The Simple Ajax Chat plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability in all versions up to and including 20260811. This vulnerability allows unauthenticated attackers to inject malicious scripts via chat messages, which are then persistently stored and executed in the browsers of users who view the chat. The nonce intended to protect message submission is publicly visible, making it ineffective as an authentication barrier.
CVSS v3.1
Score 7.2high
Affected software
specialk
Simple Ajax Chat – Add a Fast, Secure Chat Box
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-81825 is a stored cross-site scripting vulnerability in the Simple Ajax Chat – Add a Fast, Secure Chat Box WordPress plugin. Due to insufficient input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts through chat messages. The nonce used for message submission is publicly visible on the chat page, allowing attackers to bypass authentication and submit malicious messages that persistently execute in users' browsers upon page load. This affects all versions up to and including 20260811.
Potential Impact
An attacker can execute arbitrary scripts in the context of users visiting pages with the injected chat messages. This can lead to information disclosure and integrity loss of user data. The vulnerability does not affect availability. The attack requires no authentication and can affect all visitors to the chat page.
Mitigation Recommendations
No patch or official fix is currently available. Users should monitor the vendor advisory for updates. Until a fix is released, consider disabling the plugin or restricting access to the chat feature to trusted users only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-27T13:32:01.254Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa379d891cc7f38489ada43
Added to database: 09/11/2026, 03:47:36 UTC
Last enriched: 09/11/2026, 04:01:53 UTC
Last updated: 09/11/2026, 04:11:24 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.