CVE-2026-18555: Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using the Better Messages plugin at version 2.15.22 or earlier are affected. The referenced change is in version 2.15.23, indicating that release contains the relevant fix.
What does an attacker need to exploit this issue?
An attacker does not need authentication and can supply a malicious value through the icn parameter. Exploitation requires convincing a user to perform an action such as clicking a crafted link, after which injected script can execute in that user's browser.
What can be done if updating is not immediately possible?
The provided data does not identify a configuration workaround. Until the plugin can be updated, reduce exposure to untrusted links that may target affected Better Messages pages and treat unexpected links containing the icn parameter as suspicious.