Better Messages EUVD-2026-86549

Requires the Better Messages plugin (<=3.0.4) installed and active on a WordPress site, plus the attacker holding at least a subscriber-level account - so sites permitting open/self-service registration are most exposed, while sites restricting account creation limit reach. The core enabling condition is that the display-name value is processed only by sanitize_text_field(), which preserves HTML-entity-encoded content, and the plugin then decodes it server-side before output; this specific decode-after-sanitize behavior is what lets low-privilege users bypass the normal unfiltered_html capability gate. No victim interaction beyond viewing a page that renders the attacker's display name is needed, and no non-default plugin configuration is required.

This is a mid-severity, authentication-gated stored/DOM XSS with a realistic but bounded threat profile. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates a remotely-reachable, low-complexity attack that requires only subscriber-level authentication (PR:L) and, notably, NO victim interaction beyond normal browsing (UI:N) - any user who views a page rendering the malicious display name executes the payload. The scope-change (S:C) reflects that the injected script runs in other users' browser contexts. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so per available data this is 'no public exploit identified at time of analysis.' The interesting technical signal is the described sanitization bypass: WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads, and the plugin decodes them server-side before output - meaning the standard unfiltered_html capability restriction that normally protects low-privilege users is defeated. That elevates real-world plausibility above a typical 'requires trusted author' XSS. Net: a genuine issue worth patching promptly on affected sites that allow open/subscriber registration, but absent EPSS/KEV/POC signals it is not an emergency-tier, mass-exploited flaw. Impact is limited to C:L/I:L (session/context compromise of viewers), not full site takeover.

An attacker registers a subscriber-level account (or uses any low-privilege account) on a WordPress site running Better Messages and sets their display name to an HTML-entity-encoded XSS payload (e.g., an iframe srcdoc attribute) that survives sanitize_text_field(). The plugin later decodes and renders the display name in chat/message UI, so any user - including administrators - who views a page showing that name has arbitrary JavaScript executed in their browser session. No public exploit code was identified in the provided intelligence, but the bypass technique is described in detail by the Wordfence advisory.