BP Better Messages vulnerabilities

The WordPress plugin BP Better Messages up to version 3.1.3 is vulnerable to DOM-based XSS due to improper neutralization of input during web page generation. An attacker could exploit DOM manipulation to execute a malicious script in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages versions up to 2.15.27.

BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

CVE-2026-42736 describes an authorization bypass vulnerability through a user-controlled key in the BP Better Messages plugin. This issue affects versions from n/a through 2.14.16 inclusive.