Bp Better Messages
Monthly
DOM-based cross-site scripting in the BuddyPress-dependent BP Better Messages WordPress plugin affects versions through 3.1.3 and lets an attacker deliver crafted content that executes in a victim's browser after the victim interacts with it. The reported severity is 7.1 (High), with the assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no attacker authentication is required but victim interaction is mandatory and the payload runs client-side rather than on the server. The supplied intelligence does not confirm active exploitation (no CISA KEV flag) and no public exploit is identified at time of analysis; the exact plugin feature or parameter that sinks the input is not described.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
DOM-based cross-site scripting in the BuddyPress-dependent BP Better Messages WordPress plugin affects versions through 3.1.3 and lets an attacker deliver crafted content that executes in a victim's browser after the victim interacts with it. The reported severity is 7.1 (High), with the assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no attacker authentication is required but victim interaction is mandatory and the payload runs client-side rather than on the server. The supplied intelligence does not confirm active exploitation (no CISA KEV flag) and no public exploit is identified at time of analysis; the exact plugin feature or parameter that sinks the input is not described.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.