Cross-Site Scripting Flaw in BP Better Messages by WordPress
CVE-2026-114179

7.1HIGH

Key Information:

Vendor

WordPress
Status
Bp Better Messages
Vendor
CVE Published:
24 October 2026

What is CVE-2026-114179?

A Cross-Site Scripting (XSS) vulnerability exists in the BP Better Messages plugin for WordPress, specifically in versions from n/a to 3.1.3. This flaw results from improper neutralization of input during web page generation, which can lead to DOM-Based XSS attacks. If exploited, attackers could execute arbitrary JavaScript in the context of authenticated users, potentially compromising sensitive data and user sessions.

Affected Version(s)

BP Better Messages 0 <= 3.1.3

References

https://patchstack.com/database/wordpress/plugin/bp-bette...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Ryan Albon | Patchstack Bug Bounty Program
.