Description

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:16:53.347Z",
  "pubdate": "2026-08-18T15:16:53.347Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the BP Better Messages plugin, specifically affecting versions 2.15.22 and prior. This security flaw enables remote, unauthenticated threat actors to inject malicious JavaScript payloads into vulnerable application endpoints. When executed, the injected script runs within the context of a victim's browser session, allowing attackers to hijack user sessions, steal sensitive authentication tokens, perform unauthorized actions on behalf of the user, or deface the affected web application. The presence of this vulnerability in an unauthenticated attack vector significantly elevates the overall risk profile, as malicious actors require no prior access privileges or credentials to initiate an attack against targeted WordPress installations utilizing the affected plugin. Exploitation relies on the application failing to properly sanitize or encode user-supplied input before rendering it back to the client. Consequently, any user viewing the compromised content becomes a vector for further malicious activity, presenting substantial risk to confidentiality, integrity, and availability of user-associated data within the ecosystem.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw stemming from insufficient input sanitization and output encoding within the BP Better Messages plugin for versions 2.15.22 and below. The root cause lies in the application's failure to adequately validate, filter, or escape user-controlled input parameters before reflecting them in HTTP responses or storing them for subsequent retrieval and rendering in the Document Object Model (DOM).\nBecause the vulnerability is unauthenticated, an external attacker does not need to establish a valid user session or acquire specific application privileges to interact with the vulnerable component. Network exposure is broad, as the vulnerable endpoints are typically accessible via standard HTTP/HTTPS protocols over the web interface.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTTP request containing a payload consisting of executable JavaScript encapsulated within HTML tags or event handlers. Second, the attacker transmits this unauthenticated payload to the vulnerable endpoint exposed by the BP Better Messages plugin. Third, the application processes the request and improperly stores or reflects the unsanitized input without applying context-aware output encoding. Fourth, when an unsuspecting user or administrative entity accesses the affected page or message view containing the injected data, the browser parses the response as active markup. Finally, the browser executes the malicious JavaScript payload within the victim's active session context.\nThe payload behavior allows the script to access the Document Object Model (DOM), manipulate page content, read cookies or session identifiers accessible via JavaScript, and execute arbitrary API requests via asynchronous JavaScript and XML (AJAX) or Fetch calls under the victim's credentials. Post-exploitation impact includes session hijacking, account takeover, unauthorized data exfiltration, and potential privilege escalation if an administrative user falls victim to the injected script."
}