CVE-2026-2987

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2987", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-22T18:02:43.332Z", "datePublished": "2026-03-12T12:26:31.512Z", "dateUpdated": "2026-04-08T16:47:20.751Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:20.751Z"}, "affected": [{"vendor": "specialk", "product": "Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "20260217", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c07dec6-ddb7-45df-8bdf-57f562102c4b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3472258/simple-ajax-chat"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kazuma Matsumoto"}], "timeline": [{"time": "2026-02-25T18:23:55.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-12T00:21:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T13:05:51.979675Z", "id": "CVE-2026-2987", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:06:05.621Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T13:05:51.979675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:05:58.901Z"}}], "cna": {"title": "Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'", "credits": [{"lang": "en", "type": "finder", "value": "Kazuma Matsumoto"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "specialk", "product": "Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20260217"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-25T18:23:55.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-12T00:21:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c07dec6-ddb7-45df-8bdf-57f562102c4b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3472258/simple-ajax-chat"}], "descriptions": [{"lang": "en", "value": "The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:20.751Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2987", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:20.751Z", "dateReserved": "2026-02-22T18:02:43.332Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-12T12:26:31.512Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box", "vendor": "specialk", "versions": [{"lessThanOrEqual": "20260217", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Simple Ajax Chat para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'c' en versiones hasta, e incluyendo, la 20260217 debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto posibilita que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-2987", "lastModified": "2026-06-17T10:32:27.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2987", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T13:05:51.979675Z", "version": "2.0.3"}}]}, "published": "2026-03-12T13:16:14.370", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3472258/simple-ajax-chat"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c07dec6-ddb7-45df-8bdf-57f562102c4b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,20260217]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box", "source": "cna", "vendor": "specialk"}, "product": "simple_ajax_chat_\u2013_add_a_fast,_secure_chat_box", "vendor": "specialk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-18T14:59:24.222104+00:00", "value": {"mitigation_remediation": ["Update Simple Ajax Chat to a version newer than 20260217", "If an update is unavailable, consider disabling the plugin until a fix is released", "Monitor the sites for unusual script activity and ensure content security policies block unexpected inline scripts"], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Simple Ajax Chat plugin provided by specialk:Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box. All releases up to and including version 20260217 are impacted. Users running any of these versions are at risk.", "description_and_impact": "The Simple Ajax Chat plugin for WordPress is susceptible to a stored cross\u2011site scripting (XSS) flaw triggered by the 'c' parameter. Input supplied through this parameter is neither properly sanitized nor escaped before being saved and displayed. This allows an unauthenticated attacker to embed arbitrary JavaScript into chat message pages. When a user loads a page that contains the malicious content, the injected script runs in the context of the victim's browser, potentially exposing the site to web\u2011script attacks.", "risk_and_exploitability": "CVSS v3.1 score of 6.1 indicates a moderate severity with potential for widespread impact. EPSS score is reported as less than 1%, suggesting a low probability of real\u2011world exploitation at present. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an unauthenticated user to submit a request with a malicious 'c' parameter value to the plugin's endpoint; no authentication or special privileges are needed, but the attacker must be able to target the affected WordPress site."}}}}, "created": "2026-03-13T09:53:13.639037+00:00", "updated": "2026-03-20T15:49:50.706082+00:00", "vendors": ["specialk", "specialk$PRODUCT$simple_ajax_chat_\u2013_add_a_fast,_secure_chat_box", "wordpress", "wordpress$PRODUCT$wordpress"]}