CVE-2024-1983

HIGH

Published Mar 20, 2024 Modified May 5, 2025

Description

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.

Is your site exposed to CVE-2024-1983?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affected Products

Vendor	Product	Versions
plugin-planet	simple_ajax_chat	< 20240223

References

Exploits

https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/ https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/

Frequently Asked Questions

What is CVE-2024-1983? +

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users. It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2024-1983? +

CVE-2024-1983 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-1983? +

CVE-2024-1983 affects products from plugin-planet, specifically: simple_ajax_chat. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1983? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-46239 6.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS.This …

CVE-2025-46240 6.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counter allows Stored …

CVE-2024-0979 6.1

The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions …

CVE-2024-2470 5.4

The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow …

CVE-2024-5002 4.8

The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow …