Description

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T17:17:29.033Z",
  "pubdate": "2026-09-03T17:17:29.033Z",
  "executiveSummary": "The BP Better Messages plugin, in all versions up to and including 2.15.27, is susceptible to an Unauthenticated Cross-Site Scripting (XSS) vulnerability. This security flaw allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript code within the browsers of unsuspecting users, including site administrators.\nThe vulnerability arises from improper sanitization of user-supplied input before rendering it in the application's interface. By crafting a malicious request, an attacker can bypass security controls to execute scripts in the context of the victim's session.\nThe primary risk implications include session hijacking, unauthorized actions performed on behalf of the victim, redirection to malicious domains, and the exfiltration of sensitive information such as CSRF tokens or session cookies. Because the vulnerability is unauthenticated, it does not require a legitimate account to exploit, significantly increasing the attack surface and potential for automated exploitation across vulnerable WordPress installations. Successful exploitation could lead to full account takeover if an administrator is targeted.",
  "technicalDetails": "The vulnerability is identified as a Stored or Reflected Cross-Site Scripting (XSS) flaw within the BP Better Messages plugin environment. The root cause is the failure of the plugin to adequately validate and sanitize input parameters before reflecting them into the Document Object Model (DOM) of the browser.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP request containing a payload—typically a script tag or an HTML attribute with JavaScript URI handlers—targeted at a vulnerable endpoint handled by the BP Better Messages plugin. Because the plugin processes these inputs without rigorous content filtering or context-aware output encoding, the payload is persisted or reflected back to the browser.\nWhen a victim, such as a site administrator, views the affected page or message component, the browser parses the malicious input as legitimate code rather than data. This leads to the execution of the attacker's script within the victim's browser session. The vulnerability leverages the lack of server-side input sanitization during the data processing phase and a concurrent lack of output escaping when rendering the message body or relevant plugin data fields.\nTechnical exploitation requirements involve the attacker knowing the specific URL path or API endpoint utilized by BP Better Messages to process incoming message data or user configuration settings. Once the payload is successfully injected, it executes with the privileges of the victim, effectively bypassing any administrative access controls that might otherwise be protected by session-based authentication mechanisms. The impact is exacerbated by the fact that the injection occurs outside of the standard authentication flow, allowing non-privileged users or external actors to trigger the vulnerability without prior system access.\nPost-exploitation activities are limited only by the capabilities of the injected JavaScript. Attackers commonly use this primitive to perform actions such as modifying user account details, creating new administrative accounts, or intercepting sensitive data currently displayed on the page. Furthermore, if the victim is an administrator, the attacker may gain persistent control over the WordPress instance by modifying plugin files or uploading malicious themes, resulting in a full system compromise."
}