Bp Better Messages

BP Better Messages: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input reaches unsafe client-side DOM handling and can execute script in the affected site origin after victim interaction. The export does not disclose the DOM source, sink or victim role. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 3.1.3.

Better Messages (affected: <= 3.0.4). A Subscriber or higher can store an HTML-entity-encoded payload in their display name without unfiltered_html. WordPress's text sanitization preserves that encoding, and Better Messages subsequently decodes it before unsafe rendering, allowing stored DOM-based script execution for message viewers. The precise client-side sink is unspecified.

Better Messages (affected: <= 3.0.4). A Subscriber or higher can supply group_id message metadata that reaches a SQL query without adequate parameter binding. This can disclose database information. Exploitation requires BuddyBoss Platform installed with Social Groups disabled and its retained wp_bp_groups table; a site that previously disabled Groups can satisfy that prerequisite. The request endpoint and query function are unspecified.

A caller can retrieve chat-room transcripts, thread metadata and user data when only_joined_can_read remains at its default value of 0. The export inconsistently describes both custom-level authenticated access and access without authentication; it does not establish a clear minimum role or identify the endpoint. Treat private-room data as exposed under the stated configuration without claiming a proven anonymous path for every installation. Authoritative affected range: <= 2.15.33. Confirmed remediation: 3.0.3.

An unauthenticated guest registration stores X-Real-IP verbatim as the guest IP address. is_ai_bot_user() treats an ai-chat-bot- prefix in that value as an internal bot identity, and user_can_join()/user_can_read() then bypass role allowlists, draft-room checks and join filters. The forged identity can join restricted rooms, post messages and read private history. The exact registration route is not disclosed. Authoritative affected range: <= 2.15.33. Confirmed remediation: 3.0.3.

Through 2.15.22, unauthenticated attackers can craft a request using the icn parameter that reflects insufficiently sanitized and escaped input into a response. A victim must follow the crafted link for script execution in the site's origin. The export does not disclose the route, handler or precise output context.

BP Better Messages through 2.15.27 allows unauthenticated attacker-controlled input to reach browser output without adequate neutralization. A victim who interacts with the affected messaging content can execute script in the site's origin.

BP Better Messages is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 2.15.22.

Better Messages through 2.15.19 lets an Administrator store a sticker file URL containing ../ traversal through normalize_sticker(), which applies esc_url_raw() but does not remove traversal segments. A DELETE request to /wp-json/better-messages/v1/admin/sticker-packs/{id}/stickers/{sticker_id} reaches delete_sticker(); its uploads-URL prefix test passes before the relative path is URL-decoded and appended to the uploads directory, after which unlink() deletes the resolved target. This can remove arbitrary files readable by the hosting account and may lead to denial of service or code execution depending on the file removed.

BP Better Messages is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.14.16.

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BP Better Messages is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Bp Better Messages is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

Bp Better Messages is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

Bp Better Messages is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Bp Better Messages is affected by denial of service. Exposure depends on how the affected operation is made reachable by the site. A successful request can exhaust or disrupt the affected operation and make site functionality unavailable.

Bp Better Messages is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.