BP Better Messages CVE-2026-84812

The target WordPress site must have the BP Better Messages plugin installed and active at version 2.15.27 or earlier. An unauthenticated attacker must be able to submit content through the plugin's messaging interface (e.g., a publicly accessible message submission form or inbox). A victim user must subsequently view the page containing the injected payload (UI:R). Exploitation is most impactful when the victim is a privileged WordPress user (editor or administrator). There is no requirement for special network position, credentials, or non-default configuration - the attack surface is the messaging interface itself. Exploitation is bounded by the victim-interaction requirement and the need for the plugin to be installed and unpatched.

CVSS 7.1 with AV:N/AC:L/PR:N/UI:R/S:C accurately captures the threat profile: low-complexity, network-delivered, unauthenticated injection with victim-interaction as the sole gating factor. The scope change is the key CVSS driver - injected JavaScript can target WordPress administrator sessions, not just the messaging plugin context, making this more impactful than a typical reflected XSS. No EPSS score is available to quantify exploitation probability, and the absence of a KEV listing or known POC suggests no confirmed in-the-wild exploitation at time of analysis. That said, even a mid-sized municipal IT team in sopot running a BuddyPress community portal should treat this as actionable given the zero-authentication injection path and the broad attacker pool capable of exploiting reflected or stored XSS. The primary real-world constraint is the UI:R requirement - an attacker must induce a target to view the injected content, which is routinely achievable via phishing or social engineering on messaging platforms.

An unauthenticated attacker submits a crafted message containing a JavaScript payload through the BP Better Messages interface on a public-facing WordPress community site. When an authenticated user - particularly an administrator - opens the message thread in their browser, the unescaped payload executes and exfiltrates their WordPress session cookie to an attacker-controlled server, granting the attacker full administrative access to the WordPress installation. No public POC has been identified, but the low technical barrier of XSS exploitation makes this scenario straightforward for any attacker with basic web security knowledge.