Wordplus
Monthly
DOM-based cross-site scripting in the BuddyPress-dependent BP Better Messages WordPress plugin affects versions through 3.1.3 and lets an attacker deliver crafted content that executes in a victim's browser after the victim interacts with it. The reported severity is 7.1 (High), with the assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no attacker authentication is required but victim interaction is mandatory and the payload runs client-side rather than on the server. The supplied intelligence does not confirm active exploitation (no CISA KEV flag) and no public exploit is identified at time of analysis; the exact plugin feature or parameter that sinks the input is not described.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Stored DOM-based cross-site scripting in the Better Messages WordPress plugin (all versions up to and including 3.0.4) lets any authenticated subscriber-level user persist arbitrary script through their WordPress display name, which then executes in the browser of anyone who views a page that renders that name. Because the value is only run through sanitize_text_field() and the plugin subsequently decodes it server-side before rendering, a low-privilege account bypasses the normal unfiltered_html capability gate, and no victim interaction beyond page view is required. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a mid-severity, authentication-gated issue with a realistic but bounded threat profile, most dangerous on sites that permit open or self-service registration; no public exploit identified at time of analysis.
Authenticated SQL injection in the Better Messages WordPress plugin (versions up to and including 3.0.4) allows subscribers and higher-privileged users to extract sensitive database information via the 'group_id' parameter, but only when the BuddyBoss Platform plugin is installed with its Social Groups component disabled and the wp_bp_groups table remains present. The vulnerability has a base CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability impact; the independent assessment rates attack complexity as High (AC:H) due to the specific configuration prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.
Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
DOM-based cross-site scripting in the BuddyPress-dependent BP Better Messages WordPress plugin affects versions through 3.1.3 and lets an attacker deliver crafted content that executes in a victim's browser after the victim interacts with it. The reported severity is 7.1 (High), with the assessed vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no attacker authentication is required but victim interaction is mandatory and the payload runs client-side rather than on the server. The supplied intelligence does not confirm active exploitation (no CISA KEV flag) and no public exploit is identified at time of analysis; the exact plugin feature or parameter that sinks the input is not described.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Arbitrary file deletion in the Better Messages WordPress plugin allows authenticated administrators to delete arbitrary server files by exploiting a path traversal flaw in the delete_sticker function. The vulnerability, present in versions up to 2.15.19, enables an attacker with admin access to craft a URL that bypasses directory restrictions via embedded ../ sequences, potentially leading to remote code execution when critical files such as wp-config.php are deleted. No active exploitation or public proof-of-concept has been reported at this time.
Stored DOM-based cross-site scripting in the Better Messages WordPress plugin (all versions up to and including 3.0.4) lets any authenticated subscriber-level user persist arbitrary script through their WordPress display name, which then executes in the browser of anyone who views a page that renders that name. Because the value is only run through sanitize_text_field() and the plugin subsequently decodes it server-side before rendering, a low-privilege account bypasses the normal unfiltered_html capability gate, and no victim interaction beyond page view is required. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a mid-severity, authentication-gated issue with a realistic but bounded threat profile, most dangerous on sites that permit open or self-service registration; no public exploit identified at time of analysis.
Authenticated SQL injection in the Better Messages WordPress plugin (versions up to and including 3.0.4) allows subscribers and higher-privileged users to extract sensitive database information via the 'group_id' parameter, but only when the BuddyBoss Platform plugin is installed with its Social Groups component disabled and the wp_bp_groups table remains present. The vulnerability has a base CVSS score of 6.5 (Medium) with high confidentiality impact but no integrity or availability impact; the independent assessment rates attack complexity as High (AC:H) due to the specific configuration prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.
Authorization bypass in the Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress (all versions up to and including 2.15.33) allows authenticated users with custom-level access or above to retrieve the full message transcript, thread metadata and participant user data of chat-room threads they are not members of. The root cause is a missing authorization check (CWE-862) on the plugin's REST endpoints, and exploitation is further gated on a target room's only_joined_can_read setting retaining its default value of '0' - rooms reconfigured to '1' are not affected. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N, confidentiality-only impact), this is a real but moderate-priority confidentiality issue rather than a critical emergency; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Reflected cross-site scripting in the Better Messages WordPress plugin (Chat Rooms, Group Chat, Private Messages & AI Chat Bots) affects all versions up to and including 2.15.22, where the 'icn' parameter is neither sanitized on input nor escaped on output. An attacker who can craft a link with a malicious 'icn' value and persuade a logged-in or anonymous visitor to click it can execute arbitrary JavaScript in that victim's browser context on the affected site. No public exploit code or active exploitation has been reported, but the flaw is trivially automatable and the fix is already published in the 2.15.23 tag.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.