BP Better Messages WordPress plugin: Stored Cross-Site Scripting
Summary
The WordPress plugin BP Better Messages up to and including version 3.2.1 contains a stored Cross-Site Scripting (XSS) vulnerability. An attacker with a low-privileged account (for example Subscriber) can store a malicious script in the messaging feature, which runs in the browser of another user who views it. Successful exploitation requires that a privileged user performs an action such as opening a crafted message, and it can lead to data theft or account hijacking.
Affected
- BP Better Messages (WordPress plugin, bp-better-messages) from n/a through 3.2.1
- Required privilege: Subscriber (low)
- Unknown: earlier affected versions beyond the stated range
Fixed in
- Version 3.2.2 (reported by Patchstack and CVE record; not yet independently confirmed on wordpress.org or the vendor changelog)
Workaround
- No vendor workaround documented.
- Until updated, restrict who can register or use messaging roles to reduce the number of users who can plant payloads.
Exploitation
- No public proof-of-concept known as of 10 Nov 2026.
- No evidence of exploitation in the wild; not listed in CISA KEV.
- Patchstack expects exploitation and notes mass-exploit campaigns for vulnerabilities of this type.
- Status may change; sources are only hours old.
Our recommendation
- Update BP Better Messages to version 3.2.2 or later and verify the installed version in the WordPress admin.
- If an update is not possible immediately, limit registration and messaging access.
- Check whether admins or staff use the messenger inside the admin area and review messages for suspicious scripts.
- Monitor for updates, as this vendor has had several recent XSS issues (CVE-2026-114179, CVE-2026-94376).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OffSeq Radar radar.offseq.com
- VulDB vuldb.com
- Strix CVE-2026-124257 www.strix.ai
- CVE mirror (threatint) cve.threatint.com
- WordPress.org plugin page wordpress.org
- Better Messages changelog www.better-messages.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:51.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.