CVE-2022-27850

CVE-2022-27850 : WordPress plugin Simple Ajax Chat contains a Cross-Site Request Forgery (CSRF) flaw up to version 20220115 that lets an attacker clear chat logs or delete messages. Public records note the vulnerable component is the plugin’s chat-management actions and that updating to at least ...

CVE-2024-2470

CVE-2024-2470 affects the WordPress plugin Simple Ajax Chat, with the issue occurring in versions prior to 20240412. The vulnerability stems from insufficient sanitisation/escaping of certain plugin settings, enabling Stored XSS by high-privilege users (e.g., administrators), even when unfiltered...