CVE-2026-94376
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Better Messages plugin for WordPress (versions up to and including 3.0.4) is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name. Due to insufficient input sanitization and output escaping, an authenticated attacker with subscriber-level access can store a malicious script that executes whenever a user accesses the injected page.
Risk Assessment
A low-privileged attacker (subscriber) can persistently inject malicious JavaScript into the application, potentially leading to session theft, account takeover, or modification of content visible to other users.
Recommendation
Update the Better Messages plugin to a version newer than 3.0.4 as soon as a fix is available, and consider restricting subscriber registration until the patch is applied.
Other vulnerabilities in Better Messages WordPress Plugin
Original NVD description (English source)
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS