CVE-2021-24808

The BP Better Messages WordPress plugin before 1.9.9.41 sanitise with sanitizetextfield but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24808 BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting

The BP Better Messages WordPress plugin before 1.9.9.41 sanitise with sanitizetextfield but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24808

The CVE-2021-24808 entry describes a Reflective Cross-Site Scripting in the BP Better Messages WordPress plugin prior to version 1.9.9.41. Root cause: the plugin sanitises the subject via sanitize_text_field but fails to escape it when outputting back into an HTML attribute, enabling attack strin...