| 2026-10-21 |
WPSEC-2026-1325 |
Better Messages <= 3.1.3 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'bmErrors' Parameter |
Medium 6.1 |
3.1.4 |
| 2026-10-20 |
WPSEC-2026-1267 |
Better Messages <= 3.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery via Link Preview |
Medium 6.4 |
3.1.3 |
| 2026-10-16 |
WPSEC-2026-1116 |
Better Messages <= 3.0.14 - Authenticated (Subscriber+) Sensitive Information Exposure via 'reply_to' Message Meta in AI Chat Bot Conversations |
Low 3.1 |
3.1.0 |
| 2026-10-16 |
WPSEC-2026-1115 |
Better Messages <= 3.0.14 - Authenticated (Subscriber+) Sensitive Information Exposure of Pending Moderation Messages via 'lazyPool' REST Endpoint |
Medium 4.3 |
3.1.0 |
| 2026-10-10 |
WPSEC-2026-0731 |
Better Messages <= 3.0.13 - Unauthenticated Missing Authorization to User Listing via getUsers REST API Endpoint |
Medium 5.3 |
3.0.14 |
| 2026-10-01 |
WPSEC-2026-0124 |
Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure of Hidden Chat Room Participants via 'getChatRooms' REST Endpoint |
Medium 4.3 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0123 |
Better Messages <= 3.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure via Favorites Page |
Medium 4.3 |
3.0.12 |
| 2026-10-01 |
WPSEC-2026-0122 |
Better Messages <= 3.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting via End-to-End Encrypted Messages |
Medium 6.4 |
3.0.12 |
