Better Messages Chat Rooms Group Chat Private Messages Ai Chat Bots
Monthly
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.