CVE-2026-114179
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WordPress plugin BP Better Messages up to version 3.1.3 is vulnerable to DOM-based XSS due to improper neutralization of input during web page generation. An attacker could exploit DOM manipulation to execute a malicious script in the victim's browser.
Risk Assessment
This could lead to theft of credentials, session hijacking, or other actions on behalf of the user. The risk is particularly high on multi-user sites.
Recommendation
Update the BP Better Messages plugin to a version newer than 3.1.3. Additionally, audit JavaScript code for secure data handling.
Other vulnerabilities in BP Better Messages
See all- CVE-2026-84812High
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages versions up to 2.15.27.
- CVE-2026-32547High
BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-42736High
CVE-2026-42736 describes an authorization bypass vulnerability through a user-controlled key in the BP Better Messages plugin. This issue affects versions from n/a through 2.14.16 inclusive.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS