Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

124 matches found

Cvelist
Cvelist•added 2026/07/28 5:39 a.m.•43 views

CVE-2026-16585 Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

7.2CVSS0.00734EPSS
SaveExploits0References6
CVE
CVE•added 2026/07/28 5:39 a.m.•17 views

CVE-2026-16585

Technical details (affected versions, root cause, impact, and fixes) are not publicly available in the provided documents; monitor for updates.

7.2CVSS6.6AI score0.00734EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE•added 2026/06/05 7:15 p.m.•13 views

CVE-2026-42736

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS5.4AI score0.00256EPSS
SaveExploits0References1
NVD
NVD•added 2026/05/27 11:16 a.m.•21 views

CVE-2026-42736

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS0.00256EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment•added 2026/05/27 9:49 a.m.•10 views

CVE-2026-42736 WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB•added 2026/05/27 9:49 a.m.•7 views

CVE-2026-42736

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0References2
EUVD
EUVD•added 2026/05/27 9:49 a.m.•17 views

EUVD-2026-32188

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0References1
CVE
CVE•added 2026/05/27 9:49 a.m.•24 views

CVE-2026-42736

BP Better Messages WordPress plugin ≤ 2.14.16 is affected by an Insecure Direct Object Reference (IDOR) vulnerability that enables an authorization bypass via a user-controlled key due to misconfigured access controls. Affected component: BP Better Messages plugin for WordPress; root cause: impro...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0References1
Cvelist
Cvelist•added 2026/05/27 9:49 a.m.•34 views

CVE-2026-42736 WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS0.00256EPSS
SaveExploits0References1
Patchstack
Patchstack•added 2026/05/27 2:2 a.m.•15 views

WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by dodoh4t in WordPress Plugin BP Better Messages versions = 2.14.16...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0Affected Software1
CNNVD
CNNVD•added 2026/05/27 12:0 a.m.•16 views

WordPress plugin BP Better Messages 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies•added 2026/05/27 12:0 a.m.•22 views

PT-2026-43648

Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through = 2.14.16...

7.5CVSS5.8AI score0.00256EPSS
SaveExploits0References2
Patchstack
Patchstack•added 2026/05/01 9:33 a.m.•7 views

WordPress Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages plugin <= 2.6.7 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin BP Better Messages versions = 2.6.7...

6.1CVSS5.8AI score0.00276EPSS
SaveExploits0References1Affected Software1
RedhatCVE
RedhatCVE•added 2026/01/09 9:29 a.m.•15 views

CVE-2023-49168

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WordPlus Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages – Live Chat for WordPress, BuddyPress, PeepSo...

6.5CVSS6.7AI score0.00385EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2025/12/18 5:39 a.m.•16 views

CVE-2025-14154

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This make...

6.1CVSS5.2AI score0.00179EPSS
SaveExploits0References1
Patchstack
Patchstack•added 2025/12/17 7:24 a.m.•10 views

WordPress Better Messages plugin <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin BP Better Messages versions = 2.10.2...

6.1CVSS5.5AI score0.00179EPSS
SaveExploits0References1Affected Software1
NVD
NVD•added 2025/12/17 6:15 a.m.•12 views

CVE-2025-14154

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This make...

6.1CVSS0.00179EPSS
SaveExploits0References2
CVE
CVE•added 2025/12/17 5:24 a.m.•24 views

CVE-2025-14154

CVE-2025-14154 – The WordPress plugin “Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss” is affected by a Stored Cross-Site Scripting (XSS) via guest display name in all versions up to 2.10.2 due to insufficient input sanitization and output escaping. The ...

6.1CVSS4.9AI score0.00179EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2025/12/17 5:24 a.m.•4 views

CVE-2025-14154 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This make...

6.1CVSS4.9AI score0.00179EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2025/12/17 5:24 a.m.•39 views

CVE-2025-14154 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This make...

6.1CVSS0.00179EPSS
SaveExploits0References2
Rows per page
Query Builder