Advisories · Technology
wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots.
Every CVE that names wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- SQL injection
- CVSS 5.3 Medium
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Authentication bypass
- CVSS 6.5 Medium
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Broken access control
- CVSS 6.1 Medium
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Cross-site scripting (XSS)
- CVSS 7.2 High
Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Path traversal