Better Messages Chat Rooms Group Chat Private Messages Ai Chat Bots
Monthly
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Stored DOM-based cross-site scripting in the Better Messages WordPress plugin (all versions up to and including 3.0.4) lets any authenticated subscriber-level user persist arbitrary script through their WordPress display name, which then executes in the browser of anyone who views a page that renders that name. Because the value is only run through sanitize_text_field() and the plugin subsequently decodes it server-side before rendering, a low-privilege account bypasses the normal unfiltered_html capability gate, and no victim interaction beyond page view is required. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a mid-severity, authentication-gated issue with a realistic but bounded threat profile, most dangerous on sites that permit open or self-service registration; no public exploit identified at time of analysis.
Authenticated SQL injection in the Better Messages WordPress plugin (versions up to and including 3.0.4) allows subscribers and higher-privileged users to extract sensitive database information via the 'group_id' parameter, but only when the BuddyBoss Platform plugin is installed with its Social Groups component disabled and the wp_bp_groups table remains present. The vulnerability has a base CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability impact; the independent assessment rates attack complexity as High (AC:H) due to the specific configuration prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.
Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Stored DOM-based cross-site scripting in the Better Messages WordPress plugin (all versions up to and including 3.0.4) lets any authenticated subscriber-level user persist arbitrary script through their WordPress display name, which then executes in the browser of anyone who views a page that renders that name. Because the value is only run through sanitize_text_field() and the plugin subsequently decodes it server-side before rendering, a low-privilege account bypasses the normal unfiltered_html capability gate, and no victim interaction beyond page view is required. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a mid-severity, authentication-gated issue with a realistic but bounded threat profile, most dangerous on sites that permit open or self-service registration; no public exploit identified at time of analysis.
Authenticated SQL injection in the Better Messages WordPress plugin (versions up to and including 3.0.4) allows subscribers and higher-privileged users to extract sensitive database information via the 'group_id' parameter, but only when the BuddyBoss Platform plugin is installed with its Social Groups component disabled and the wp_bp_groups table remains present. The vulnerability has a base CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability impact; the independent assessment rates attack complexity as High (AC:H) due to the specific configuration prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.
Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.