CVE Catalog
CVE-2026-84812
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages versions up to 2.15.27.
Risk Assessment
An attacker could inject malicious scripts, potentially leading to session hijacking or other damage.
Recommendation
Update to the latest version and apply proper XSS protections.
Other vulnerabilities in BP Better Messages
See all- CVE-2026-42736High
CVE-2026-42736 describes an authorization bypass vulnerability through a user-controlled key in the BP Better Messages plugin. This issue affects versions from n/a through 2.14.16 inclusive.
- CVE-2026-32547High
BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.