Read the docs
TI-2024-01845 Aliases CVE-2024-1983GHSA-m8qw-mppg-7364

Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS

Priority MEDIUM 64Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00452 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Simple Ajax Chat (Unknown): 20240223

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple Ajax Chat before 2024022320240223Patch availableCNA
  • Simple Ajax Chat VendorUnknown Affected before 20240223 Fixed in 20240223 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plugin-planet:simple_ajax_chat:*:*:*:*:*:wordpress:*:*before 20240223Vulnerablespecialk
  • cpe:2.3:a:plugin-planet:simple_ajax_chat:*:*:*:*:*:wordpress:*:* Versions before 20240223 Vulnerable ·specialk

Remediation

  • Fix · CNA Simple Ajax Chat (Unknown) Fixed in 20240223

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1983
  2. 2026-10-03 Alias added: GHSA-m8qw-mppg-7364

References

Exploit 1

  • TI-2024-02296 Simple Ajax Chat < 20240412 - Admin+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2022-10732 WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability CVSS 3.1HIGH 7.5
  • TI-2022-09200 WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.1
  • TI-2022-10733 WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences