EUVD-2026-83478

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the isaibotuser function identifying privileged internal AI bot accounts by performing...

CVE-2026-89334

The Better Messages plugin for WordPress (chat rooms, group chat, private messages & AI chat bots) is vulnerable to authorization bypass in all versions up to and including 2.15.33 . The plugin fails to properly verify user authorization on the /thread/ REST endpoint , allowing any authenticated ...

EUVD-2026-83475

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.33 - Unauthenticated Information Exposure Spoofing vulnerability

Unauthenticated Information Exposure Spoofing vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.33...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.22 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.22...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure vulnerability

Missing Authorization to Authenticated Custom+ Chat-Room Transcript Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin BP Better Messages versions = 2.15.33...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555 Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the icn parameter in all versions up to and including 2.15.22 . The root cause is insufficient input sanitization and output escaping. An unauth...

EUVD-2026-80113

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

PT-2026-93272

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-84812

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

EUVD-2026-70570

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84812 WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84812

CVE-2026-84812 affects the WordPress BP Better Messages plugin in versions

WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin BP Better Messages versions = 2.15.27...

CVE-2026-32547

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-32547

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-32547 WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-32547

BP Better Messages plugin (WordPress) ≤ 2.15.22 has an unauthenticated reflected/stored XSS flaw; attacker-supplied input is not sanitized before output, enabling script injection. CVSS 7.1 (High). Patchstack advisory: https://patchstack.com/database/wordpress/plugin/bp-better-messages/vulnerabil...