Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Cross-site scripting
Better Messages (affected: <= 3.0.4). A Subscriber or higher can store an HTML-entity-encoded payload in their display name without unfiltered_html. WordPress's text sanitization preserves that encoding, and Better Messages subsequently decodes it before unsafe rendering, allowing stored DOM-based script execution for message viewers. The precise client-side sink is unspecified.
- Component
- Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Plugin slug
bp-better-messages- Affected
- <= 3.0.4
- Safe version
3.0.6- Published
- Sep 25, 2026
This CVE was published Sep 25, 2026 and is one of 19 known issues for this plugin.
Update, patch or deactivate.
Update to 3.0.6 or a later supported release. The official changelog confirms remediation by 3.0.6 in a grouped release entry, without identifying the first fixed version. Validate names after decoding and render them with a strict permitted-markup policy or as text in both server and browser paths; sanitize existing malicious names.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N