Better Messages <= 3.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting via End-to-End Encrypted Messages
- ID
- WPSEC-2026-0122
- Plugin
- Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots (bp-better-messages)
- Affected
- all versions before 3.0.12
- Remediation
- Update to 3.0.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Better Messages on WPSec AttackSurface
- Fix released
- Published
Description
The Better Messages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via messages in end-to-end encrypted conversations in all versions up to, and including, 3.0.11. The server cannot sanitize encrypted message bodies, and the browser stored and rendered the decrypted HTML without removing unsafe markup. This makes it possible for authenticated attackers, with subscriber-level access and above, who are members of an end-to-end encrypted conversation to send a crafted message that executes arbitrary web scripts in the browsers of the other members when they view it. End-to-end encryption is available in the plugin's WebSocket (paid) version.
References
- https://wpsec.com/vuln/WPSEC-2026-0122/
- https://plugins.svn.wordpress.org/bp-better-messages/tags/3.0.12/
- https://wordpress.org/plugins/bp-better-messages/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS