Read the docs
TI-2024-02296 Aliases CVE-2024-2470GHSA-5g6x-fqcp-phwv

Simple Ajax Chat < 20240412 - Admin+ Stored XSS

Priority MEDIUM 58CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Simple Ajax Chat (Unknown): 20240412

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownSimple Ajax Chat before 2024041220240412Patch availableCNA
  • Simple Ajax Chat VendorUnknown Affected before 20240412 Fixed in 20240412 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plugin-planet:simple_ajax_chat:*:*:*:*:*:wordpress:*:*before 20240412Vulnerablespecialk
  • cpe:2.3:a:plugin-planet:simple_ajax_chat:*:*:*:*:*:wordpress:*:* Versions before 20240412 Vulnerable ·specialk

Remediation

  • Fix · CNA Simple Ajax Chat (Unknown) Fixed in 20240412

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2470
  2. 2026-10-03 Alias added: GHSA-5g6x-fqcp-phwv

References

Exploit 1

  • TI-2024-01845 Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS CVSS 3.1HIGH 7.1
  • TI-2022-10732 WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability CVSS 3.1HIGH 7.5
  • TI-2022-09200 WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.1
  • TI-2022-10733 WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences