CVE-2026-32547
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
An attacker can steal session data, take over accounts, or spread malicious content among users.
Recommendation
Upgrade BP Better Messages to the latest version that fixes this vulnerability.
Other vulnerabilities in BP Better Messages
See all- CVE-2026-42736High
CVE-2026-42736 describes an authorization bypass vulnerability through a user-controlled key in the BP Better Messages plugin. This issue affects versions from n/a through 2.14.16 inclusive.
- CVE-2026-84812High
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages versions up to 2.15.27.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS