BP Better Messages EUVD-2026-109245

Exploitation requires that the target site runs WordPress with the BuddyPress-dependent BP Better Messages plugin at version 3.1.3 or earlier, and that a victim user interacts with attacker-supplied content (UI:R) - for example opening a crafted message or clicking a malicious link that the plugin's client-side code reflects unsafely into the DOM. The CVSS PR:N indicates no attacker authentication is needed to craft/deliver the payload, but the mandatory user interaction and the fact that the payload executes only within a victim's browser (not on the server) are the key limiting factors. The specific plugin feature, parameter, or message field that sinks the unsanitized input is not described in the available sources.

This is a DOM-based cross-site scripting flaw (CWE-79) in the BP Better Messages WordPress plugin (≤ 3.1.3), reported by Patchstack and assigned a 7.1 (High) CVSS 3.1 score. The supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity, unauthenticated triggering (PR:N) that nonetheless requires victim interaction (UI:R) and crosses a scope boundary (S:C) with only low confidentiality, integrity and availability impact - a signature consistent with reflected/DOM XSS executing in a victim's browser rather than full server compromise. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no SSVC machine-readable decision block was supplied; the only triage signal is vuln.today's 'this_week' priority label. The single reference is a Patchstack advisory entry, not working exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The UI:R requirement (a victim must load attacker-controlled content/a crafted link) materially lowers real-world risk versus a no-interaction XSS, and the low impact metrics mean this is a genuine but moderate, non-emergency issue appropriate to the 'this_week' label rather than a high-CVSS/low-real-risk false alarm or a drop-everything priority. Note: without EPSS or KEV data, likelihood of mass exploitation cannot be quantified from the input.

An attacker crafts a malicious message, link, or input that is unsafely written into the DOM by the BP Better Messages client-side code; when a logged-in BuddyPress user views it, attacker-controlled JavaScript executes in their browser session. This could be used to steal session tokens, perform actions as the victim within the messaging interface, or pivot against the wider site. No public, verified exploit code was identified in the provided sources; only a Patchstack advisory reference exists.