{"items":[{"id":"CVE-2026-114179","published":"2026-10-24T08:00:10.535Z","updated":"2026-10-24T14:46:57.707Z","title":"WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-94376","published":"2026-09-25T06:39:57.796Z","updated":"2026-09-25T13:00:16.015Z","title":"Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name","severity":"MEDIUM","score":6.4,"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-93899","published":"2026-09-25T06:39:53.388Z","updated":"2026-09-25T13:00:17.115Z","title":"Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter","severity":"MEDIUM","score":6.5,"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-89093","published":"2026-09-19T02:27:11.997Z","updated":"2026-09-19T14:01:26.022Z","title":"Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register","severity":"MEDIUM","score":5.3,"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-89334","published":"2026-09-19T02:27:10.950Z","updated":"2026-09-19T14:01:26.491Z","title":"Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint","severity":"MEDIUM","score":6.5,"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2026-18555","published":"2026-09-16T04:28:03.363Z","updated":"2026-09-18T17:33:17.253Z","title":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter","severity":"MEDIUM","score":6.1,"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-84812","published":"2026-09-03T16:31:57.216Z","updated":"2026-09-05T01:52:44.805Z","title":"WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-32547","published":"2026-08-18T13:59:29.548Z","updated":"2026-08-18T19:48:23.801Z","title":"WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability","severity":"HIGH","score":7.1,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-16585","published":"2026-07-28T05:39:44.828Z","updated":"2026-07-28T16:05:04.482Z","title":"Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter","severity":"HIGH","score":7.2,"vendor":"wordplus","product":"Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots","kev":false,"epss":0.01153,"kevAdded":null},{"id":"CVE-2026-42736","published":"2026-05-27T09:49:04.452Z","updated":"2026-05-27T10:52:23.925Z","title":"WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability","severity":"HIGH","score":7.5,"vendor":"wordplus","product":"BP Better Messages","kev":false,"epss":0.00256,"kevAdded":null},{"id":"CVE-2024-13362","published":"2026-05-01T05:29:54.148Z","updated":"2026-05-01T13:23:26.723Z","title":"Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","severity":"MEDIUM","score":6.1,"vendor":"sebet","product":"Go Fetch Jobs (for WP Job Manager)","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2025-14154","published":"2025-12-17T05:24:55.217Z","updated":"2026-04-08T17:26:23.481Z","title":"Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting","severity":"MEDIUM","score":6.1,"vendor":"wordplus","product":"Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2024-13697","published":"2025-03-01T08:23:21.239Z","updated":"2026-04-08T17:17:25.770Z","title":"Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links","severity":"MEDIUM","score":4.8,"vendor":"wordplus","product":"Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages","kev":false,"epss":0.00284,"kevAdded":null},{"id":"CVE-2024-13611","published":"2025-03-01T08:23:20.219Z","updated":"2026-04-08T17:10:54.150Z","title":"Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"HIGH","score":7.5,"vendor":"wordplus","product":"Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2024-13612","published":"2025-02-01T12:21:30.754Z","updated":"2026-04-08T16:37:13.435Z","title":"Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"MEDIUM","score":6.4,"vendor":"wordplus","product":"Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2022-4974","published":"2024-10-16T06:43:30.014Z","updated":"2026-04-08T16:46:54.861Z","title":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","severity":"MEDIUM","score":6.3,"vendor":"dashlabsltd","product":"YASR – Yet Another Star Rating Plugin for WordPress","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2024-32802","published":"2024-05-17T09:38:31.510Z","updated":"2026-04-28T16:09:40.539Z","title":"WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability","severity":"MEDIUM","score":5.3,"vendor":"WordPlus","product":"BP Better Messages","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2023-49168","published":"2023-12-14T14:49:33.109Z","updated":"2026-04-28T16:08:56.233Z","title":"WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)","severity":"MEDIUM","score":6.5,"vendor":"WordPlus","product":"Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2022-41609","published":"2022-11-18T23:18:50.883Z","updated":"2026-04-28T16:07:49.188Z","title":"WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability","severity":"MEDIUM","score":6.4,"vendor":"WordPlus","product":"Better Messages (WordPress plugin)","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2022-40216","published":"2022-11-18T22:33:03.687Z","updated":"2026-04-28T16:07:47.971Z","title":"WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WordPlus","product":"Better Messages (WordPress plugin)","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2022-36389","published":"2022-08-23T15:48:47.656Z","updated":"2026-04-28T16:07:45.849Z","title":"WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability","severity":"MEDIUM","score":4.3,"vendor":"WordPlus","product":"Better Messages (WordPress plugin)","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2022-33142","published":"2022-08-23T15:46:18.683Z","updated":"2026-04-28T16:07:43.901Z","title":"WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability","severity":"HIGH","score":7.7,"vendor":"WordPlus","product":"Better Messages (WordPress plugin)","kev":false,"epss":0.01131,"kevAdded":null},{"id":"CVE-2022-29454","published":"2022-07-20T18:36:46.390Z","updated":"2026-04-28T16:07:42.951Z","title":"WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability","severity":"LOW","score":3.1,"vendor":"WordPlus","product":"Better Messages (WordPress plugin)","kev":false,"epss":0.00292,"kevAdded":null}]}