Simple Ajax Chat – Add a Fast, Secure Chat Box

Simple Ajax Chat – Add a Fast, Secure Chat Box has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (70%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Cross-Site Request Forgery (CSRF).

Every one of the 10 issues recorded for Simple Ajax Chat – Add a Fast, Secure Chat Box has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (3) reported by Vincent Fourcade (vinceMatsui). Simple Ajax Chat – Add a Fast, Secure Chat Box is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all Simple Ajax Chat – Add a Fast, Secure Chat Box vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-81825

Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

10 records
2026-09-10 14:45CVE-2026-81825
7.2
High
HEI LAI SZEYes
2026-09-03 00:00CVE-2026-81807
7.2
High
Erwan LRYes
2026-03-12 00:21CVE-2026-2987
6.1
Medium
Kazuma MatsumotoYes
2026-02-17 00:00CVE-2026-3075
5.3
Medium
Jakub HermanYes
2024-05-14 00:00CVE-2024-2470
4.4
Medium
Vincent Fourcade (vinceMatsui)Yes
2024-03-26 00:00CVE-2024-2956
4.4
Medium
Vincent Fourcade (vinceMatsui)Yes
2024-03-26 00:00CVE-2024-1983
7.2
High
Vincent Fourcade (vinceMatsui)Yes
2022-04-15 10:48CVE-2022-27850
5.4
Medium
R3N0Yes
2022-04-15 10:14CVE-2022-27849
5.3
Medium
R3N0Yes
2022-02-16 09:16CVE-2022-25610
5.4
Medium
Philippe DourassovYes
Showing 1–10 of 10 reports
Simple Ajax Chat – Add a Fast, Secure Chat Box banner
Latestv20260827

Simple Ajax Chat – Add a Fast, Secure Chat Box

Jeff Starr

Author

Jeff Starr

4.9(215)
98/100
Last Updated
2026-08-27 (17d ago)
Active Installs
2,000+
Downloads
182,861
Requires WP
4.7+
Requires PHP
5.6.20+
Tested up to
WP 7.1
Created
2012-11-15 (14y ago)

⭐ Lightweight and fast, persistent chat solution! ⭐ Fully self-hosted: No 3rd-party account required 🙂 Simple Ajax Chat makes it easy for your visitors to chat with each other on your website. Simply add a shortcode to any post or page and done! Instant chat forum anywhere. The chat form is fully customizable with many options, so you can create the perfect chat box for your visitors. 👉 Check out a Live Demo of Simple Ajax Chat at WP-Mix &raquo; 👉 Pro version supports unlimited chat forms! Simple Ajax Chat is fully self-hosted with NO 3rd-party service required. Many (if not all) of the other free chat plugins require registration and monthly service from a 3rd-party provider. With Simple Ajax Chat, there is no 3rd-party: WordPress is all that’s required. Own your chats! Difference between SAC free and SAC Pro The main difference between SAC free and SAC Pro? Easy: SAC free supports 1 chat form SAC Pro supports unlimited chat forms Pro can do everything free can do and SO much more. Customize each chat form with unique features. SAC Pro is an all new plugin written with smarter, faster code and all the latest techniques. Get SAC Pro &raquo; SAC Features The simplest possible persistent chat Fully self-hosted: No 3rd-party account required Ajax goodness loads new chats without page refresh Smart chat processing optimizes for performance Works with all browsers (Chrome, Firefox, Safari, etc.) Works with all mobile devices (iPhone, Android, etc.) Display easily via shortcode or template tag Display chat box in multiple locations Regularly updated & “future proof” Supports custom CSS styles Strong anti-spam security Clean HTML markup More Features Plug-&-play: no configuration required Built-in control panel to edit and delete chats Define your own list of banned words and phrases Display chat messages in ascending or descending order Display custom content before/after the chat form Option to play sound alert for chat messages Option to restrict chat to logged-in users Option to restore default plugin settings Option to enable browser notifications Export all chat messages via CSV file Supports emoticons and emojis 🙂 Customize Everything Limit maximum number of chat messages Limit maximum length of each chat message Advanced customization via filter hooks Option to use textarea for larger input field Option to use logged-in username as the chat name Option to enable/disable URL field for chat names Load JavaScript only when chat box is displayed Customize the update interval for Ajax requests Customize the fade-in colors for new chats Customize the fade-duration for new chats Plus much more! 👉 That’s a LOT of features, but the Pro version has WAY more. Compare features (free vs. pro) &raquo; Exclusive Pro Features Enable Google reCaptcha (invisible) for all chat forms Choose from six form styles, or use custom styles Advanced chat management tools and user statistics Mute any user so they are not allowed to chat Ban any non-admin users from any chat session Enable customizable emoji picker for any chat form Display user avatars next to chat messages Display the user role next to chat messages Define your own Bang (!bang) shortcuts Email notifications for new chat messages Limit number of users for any chat form Create private chat boxes between users Banned phrases in text messages and user names Fine-grain control over allowed chat content Built with vanilla JavaScript (jQuery not required) Optionally display inline images in chat messages Automatically clear chat messages and send email alert Display a “current online users” widget for any form Displays a max-character counter for messages Display a role-based chat box on the WP Dashboard Choose from six sound alerts for new chat messages Option to include your own CSS and JavaScript 👉 Learn more and get SAC Pro &raquo; Privacy This plugin collects voluntary user chat data (i.e., Name, Chat Message, and optional URL field). It also gives the administrator the option to collect or not collect user IP information. Aside from those two things, this plugin does not collect or store any user data. This plugin uses a few cookies for the chat functionality. It does not connect to any third-party locations. Minimal impact on privacy. Translations This plugin supports translation into any language &raquo; Developer Simple Ajax Chat is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C