Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T07:16:56.753Z",
  "pubdate": "2026-09-25T07:16:56.753Z",
  "executiveSummary": "The Better Messages plugin for WordPress, in versions up to and including 3.0.4, is susceptible to a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability.\nThis security flaw originates from insufficient sanitization and improper output escaping during the processing of user display names.\nAn attacker with subscriber-level privileges or higher can leverage this vulnerability to inject malicious JavaScript payloads into their profile display name.\nThe injected scripts are stored by the application and subsequently executed within the context of other users' browsers when they view pages containing the malicious display name.\nSuccessful exploitation allows for unauthorized actions, potential session hijacking, or the distribution of malicious content to administrative or privileged users.\nThe vulnerability is particularly critical due to the bypass of WordPress core's 'sanitize_text_field()' function, which does not sufficiently neutralize HTML-entity-encoded payloads, leading to downstream execution after server-side decoding.\nThis vulnerability highlights a critical failure in the plugin's data handling lifecycle, necessitating prompt mitigation to prevent persistent compromise of the WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability is the combination of inadequate input sanitization and insecure server-side decoding practices within the Better Messages plugin. WordPress core utilizes 'sanitize_text_field()' to process user input; however, this function is insufficient for preventing XSS when the input is subsequently decoded server-side and rendered in a browser context.\nThe exploitation mechanism relies on the fact that 'sanitize_text_field()' preserves HTML-entity-encoded payloads. An authenticated attacker (subscriber-level or higher) can provide a crafted payload—such as an iframe with a malicious 'srcdoc' attribute—encoded as HTML entities. Because this payload is entity-encoded, it passes initial core sanitization checks.\nUpon saving the profile display name, the plugin stores the entity-encoded string in the database. During the rendering phase, the plugin performs server-side decoding of this stored value. When the application then transmits this decoded, malicious string to the client browser, the browser interprets the previously encoded HTML elements as active code rather than passive text.\nThe attack flow follows a sequential process: First, the attacker updates their user profile display name with an entity-encoded XSS vector. Second, the plugin accepts this input, bypassing 'sanitize_text_field()' due to the encoding. Third, the malicious payload is persisted in the WordPress database. Finally, when any victim (such as an administrator or another user) visits a page where the attacker's display name is rendered—such as a chat room, group thread, or member directory—the server-side code decodes the payload, and the victim's browser executes the injected JavaScript.\nThe impact is significant, as the injected script executes within the security context of the victim's session. This allows for the theft of sensitive session cookies, the performance of unauthorized administrative operations, or the redirection of users to malicious third-party domains. Because the payload is stored persistently in the database, the vulnerability is 'stored' or 'persistent,' meaning it does not require repeated interaction from the attacker once the initial payload is successfully injected and viewed by the target audience.\nThe flaw affects all plugin versions up to and including 3.0.4, and the requirement of authenticated subscriber access makes this a highly accessible vulnerability for internal threat actors or compromised subscriber accounts."
}