WordPress plugin · simple-ajax-chat
Is Simple Ajax Chat safe?
Safe on 20260827 or newer.
The current version, 20260827, is past every affected range on record (10 of 10 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 10
- High or critical
- 3
- Exploited
- none
- Current version
- 20260827
- Last updated
- Aug 27, 2026
- Active installs
- 2,000+
Every recorded flaw
- Sep 11, 2026Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2026-81825 · affects up to 20260811 · reported by WordfenceHigh 7.2
- Sep 2, 2026Simple Ajax Chat: Does not escape chat message content before rendering itCVE-2026-81807 · fixed in 20260827 · reported by WPScanHigh 8.8
- Mar 12, 2026Simple Ajax Chat: Stored Cross-Site ScriptingCVE-2026-2987 · affects up to 20260217 · reported by WordfenceMedium 6.1
- Feb 23, 2026Simple Ajax Chat: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-3075 · affects up to 20251121 · reported by PatchstackMedium 5.3
- Jun 4, 2024Simple Ajax Chat: Does not sanitise and escape some of its settingsCVE-2024-2470 · fixed in 20240412 · reported by WPScanMedium 5.4
- Mar 27, 2024Simple Ajax Chat – Add a Fast, Secure Chat Box: Stored Cross-Site ScriptingCVE-2024-2956 · affects up to 20231101 · reported by WordfenceMedium 4.4
- Mar 20, 2024Simple Ajax Chat: Does not prevent visitors from using malicious NamesCVE-2024-1983 · fixed in 20240223 · reported by WPScanHigh 7.1
- Apr 15, 2022Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.CVE-2022-27850 · affects up to 20220115 · reported by PatchstackMedium 5.4
- Apr 15, 2022Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115CVE-2022-27849 · affects up to 20220115 · reported by Patchstack4.6% oddsMedium 5.3
- Mar 25, 2022Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code.CVE-2022-25610 · affects up to 20220115 · reported by PatchstackLow 3.4
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.