CVE-2026-124257: WordPress BP Better Messages plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Q: What access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The attack can be performed over the network with low attack complexity.

Q: What is the potential impact if exploitation succeeds?

The issue is stored cross-site scripting, meaning attacker-supplied script can be retained and later executed in another user's browser. The CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Q: Which versions are affected?

BP Better Messages versions through 3.2.1 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1.

Affected Software

1 affected component

WordPlus BP Better Messages<=3.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordplus/bp-better-messages to a version that resolves this vulnerability.
Fixed in 3.2.2

Event History

Nov 11, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The attack can be performed over the network with low attack complexity.

What is the potential impact if exploitation succeeds?

The issue is stored cross-site scripting, meaning attacker-supplied script can be retained and later executed in another user's browser. The CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Which versions are affected?

BP Better Messages versions through 3.2.1 are affected. The available data does not identify a fixed version.

CVE-2026-124257: WordPress BP Better Messages plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access and interaction are required to exploit this issue?

What is the potential impact if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction are required to exploit this issue?

What is the potential impact if exploitation succeeds?

Which versions are affected?