CVE-2022-29454

CVE-2022-29454 affects the WordPress plugin WordPlus Better Messages (versions

CVE-2022-36389

The CVE-2022-36389 entry concerns the WordPress BP Better Messages plugin, affected in versions ≤ 1.9.9.148. The issue is a Cross-Site Request Forgery (CSRF) vulnerability in the plugin. The primary impact described in the sources is high (per CVSS data), but the connected documents do not provid...

CVE-2023-49168

CVE-2023-49168 is a Stored XSS vulnerability in the WordPress plugin BP Better Messages (Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss). Affected versions are through 2.4.0; the issue arises from improper input neutralization during web page generation....

CVE-2022-41609

The CVE concerns the WordPress Better Messages plugin, version 1.9.10.68 or earlier, which is vulnerable to an authenticated Server-Side Request Forgery (SSRF) when access is allowed to subscribers. The root cause involves the plugin validating parameters before making external/internal requests,...

CVE-2022-33142

The CVE-2022-33142 issue affects WordPlus WordPress Better Messages plugin versions ≤ 1.9.10.57. It is an authenticated (subscriber+) Denial of Service vulnerability. Several sources confirm the root cause is related to DoS risk from unauthorised-length/handling issues in message processing, enab...

CVE-2024-13612

CVE-2024-13612 (Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss) is an authenticated Stored Cross-Site Scripting (XSS) vulnerability via the plugin shortcodes/better_messages_live_chat_button, affecting all versions up to 2.6.9. Exploitation requires cont...

CVE-2024-13611

CVE-2024-13611 affects the WordPress plugin Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss. The issue is Unauthenticated Sensitive Information Exposure via the bp-better-messages directory, allowing retrieval of potentially sensitive attachments stored u...

CVE-2022-40216

CVE-2022-40216 affects the WordPress Better Messages plugin. Affected versions are

CVE-2024-13697

CVE-2024-13697 documents an unauthenticated SSRF in Better Messages for WordPress (plugin versions up to 2.7.4) via the nice_links feature. Exploitation requires Enable link previews (default). The connected docs indicate a patch is available and advise upgrading to a fixed version; no further ex...

CVE-2021-24808

The CVE-2021-24808 entry describes a Reflective Cross-Site Scripting in the BP Better Messages WordPress plugin prior to version 1.9.9.41. Root cause: the plugin sanitises the subject via sanitize_text_field but fails to escape it when outputting back into an HTML attribute, enabling attack strin...

CVE-2021-24809

Affected software: WordPress BP Better Messages plugin. Vulnerability: Cross-Site Request Forgery (CSRF) in multiple AJAX actions (bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user...