What is the CVSS score of CVE-2026-84812?

CVE-2026-84812 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Which versions of BP Better Messages are affected by CVE-2026-84812?

BP Better Messages WordPress plugin versions 2.15.27 and earlier contain a cross-site scripting flaw that allows attackers to inject malicious scripts affecting authenticated users-including…

How to fix or mitigate CVE-2026-84812?

Within 24 hours, scan all WordPress installations to identify sites running BP Better Messages and their installed versions. For any instance running version 2.15.27 or earlier, either deactivate the plugin immediately or, if business-critical, implement Web Application Firewall rules to block common XSS payloads and restrict plugin access to trusted administrators. Within 7 days, confirm all vulnerable instances have been remediated (either deactivated or protected) and document the remediation status. Within 30 days, monitor the BuddyPress community and official plugin channels for a security patch release; apply the patch to version 2.15.28 or later once available and perform full site security verification.

BP Better Messages CVE-2026-84812

EUVD-2026-70570 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-09-03 Patchstack

GHSA-x6v6-8ggm-g2q9

XSS Bp Better Messages WordPress Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with scope change affecting victim sessions justifies S:C, C:L, I:L; A:N because XSS alone does not cause availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 03, 2026 - 17:12 vuln.today

CVE Published

Sep 03, 2026 - 16:31 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

AnalysisAI

Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The target WordPress site must have the BP Better Messages plugin installed and active at version 2.15.27 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.1 with AV:N/AC:L/PR:N/UI:R/S:C accurately captures the threat profile: low-complexity, network-delivered, unauthenticated injection with victim-interaction as the sole gating factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update BP Better Messages to a version above 2.15.27 immediately. … Detailed patch versions, workarounds, and compensating controls in full report.