A high-severity stored Cross-Site Scripting vulnerability in the Simple Ajax Chat WordPress plugin allows unauthenticated attackers to execute malicious scripts in the browsers of site visitors and administrators.

This vulnerability is a Cross-Site Scripting (CWE-79) flaw caused by the failure to escape chat message content before rendering. Unauthenticated attackers can inject arbitrary HTML and JavaScript, which executes when a victim views the chat interface.

Successful exploitation allows an attacker to hijack user sessions, perform unauthorized administrative actions, or redirect site traffic to malicious domains. Given the CVSS score of 8.8, this vulnerability represents a significant risk to the integrity and confidentiality of the WordPress environment, potentially leading to a full site compromise if administrative sessions are targeted.

Immediate Action: Update the Simple Ajax Chat plugin to version 20260827 or later immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor site access logs for suspicious POST requests directed at the chat functionality and implement Content Security Policy (CSP) headers to restrict unauthorized script execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block common XSS patterns within incoming chat submissions.

Public Exploit Available: No

The vulnerability poses a severe risk to WordPress installations due to the ease of exploitation by unauthenticated users. It is imperative that administrators verify their plugin versions and apply the update without delay to prevent potential account takeovers or malicious script injection within their web application.