Vulnerabilities
Summary — last 7 days
New vulnerabilities2,570▼ 302 vs. last week
Critical / high1,352▲ 100 vs. last week
New active exploitation (KEV)5▼ 7 vs. last week
Unscored (no CVSS)56▼ 472 vs. last week
10 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.2) | 0.49% | — | Plugin-planet Simple Ajax ChatAI | 9/11/2026 | 9/11/2026 | The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary… | |
| Deferred | High (8.8) | 0.51% | — | Plugin-planet Simple Ajax ChatAI | 9/2/2026 | 9/3/2026 | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators. | |
| Deferred | Medium (6.1) | 0.29% | — | Plugin-planet Simple Ajax ChatAI | 3/12/2026 | 6/17/2026 | The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will… | |
| Deferred | Medium (5.3) | 0.34% | — | Plugin-planet Simple Ajax ChatAI | 2/23/2026 | 6/17/2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Jeff Starr Simple Ajax Chat simple-ajax-chat allows Retrieve Embedded Sensitive Data.This issue affects Simple Ajax Chat: from n/a through <= 20251121. | |
| Modified | Medium (5.4) | 0.33% | — | Plugin-planet Simple Ajax Chat | 6/4/2024 | 6/17/2026 | The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |
| Deferred | Medium (4.4) | 0.33% | — | Plugin-planet Simple Ajax ChatAI | 3/27/2024 | 6/17/2026 | The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20231101 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level… | |
| Analyzed | High (7.1) | 0.45% | — | Plugin-planet Simple Ajax Chat | 3/20/2024 | 6/17/2026 | The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users. | |
| Modified | Medium (4.3) | 0.40% | — | Plugin-planet Simple Ajax Chat | 4/15/2022 | 6/17/2026 | Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message. | |
| Modified | High (7.5) | 4.6% | — | Plugin-planet Simple Ajax Chat | 4/15/2022 | 6/17/2026 | Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 | |
| Modified | Medium (6.1) | 0.72% | — | Plugin-planet Simple Ajax Chat | 3/25/2022 | 6/17/2026 | Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit. |