{"id":"CVE-2026-124257","kind":"vulnerability","aliases":["CVE-2026-124257"],"related":[],"title":"BP Better Messages WordPress plugin: stored XSS through version 3.2.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1.","summary":"BP Better Messages, a WordPress messaging plugin for BuddyPress, fails to sanitize input that is stored and later rendered in pages. An attacker can plant script that runs in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bp-better-messages","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bp-better-messages","buddypress","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the BP Better Messages plugin (bp-better-messages) in the WordPress admin plugin list, or in the plugin's main file header.\n- If the version is `3.2.1` or older, the site is in the reported range.","fix":null,"status":"open","published_at":"2026-11-11T10:16:43+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","triaged_at":"2026-11-11T10:27:01+00:00","updated_at":"2026-11-11T10:27:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T10:27:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BP Better Messages WordPress plugin: stored XSS through version 3.2.1","impact":"medium","summary":"BP Better Messages, a WordPress messaging plugin for BuddyPress, fails to sanitize input that is stored and later rendered in pages. An attacker can plant script that runs in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","buddypress","bp-better-messages"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in other users' browsers, enabling session or account takeover.","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and required privilege level; sources give only 'through 3.2.1'.","how_to_check":"- Check the installed version of the BP Better Messages plugin (bp-better-messages) in the WordPress admin plugin list, or in the plugin's main file header.\n- If the version is `3.2.1` or older, the site is in the reported range.","plain_action":"","product_name":"bp-better-messages","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the BP Better Messages WordPress plugin (bp-better-messages) at version 3.2.1 or older, where users can post messages that other users view. Sites without the plugin are not affected. The sources do not say which roles can submit the stored input.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4549,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124257':13A,16A '-2026':12A,15A '3.2.1':10A,93C 'affect':86C 'allow':82C 'attack':50B 'better':2A,19A,23B,29B,76C,80C,88C 'bp':1A,18A,22B,28B,75C,79C,87C 'bp-better-messag':21B,78C 'bp-better-messages':17A 'browser':59B 'buddypress':25B,36B 'cross':69C 'cross-sit':68C 'cve':11A,14A 'fail':37B 'generat':67C 'improp':60C 'input':40B,63C 'issu':85C 'later':45B 'messag':3A,24B,30B,33B,77C,81C,89C 'messages':20A 'n/a':91C 'neutral':61C 'packag':26B 'page':48B,66C 'plant':52B 'plugin':5A,34B 'render':46B 'run':55B 'sanit':39B 'script':53B,71C 'site':70C 'store':6A,43B,83C 'user':58B 'version':9A 'vulner':72C 'web':65C 'wordplus':74C 'wordpress':4A,27B,32B 'xss':7A 'xss.this':84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the BP Better Messages WordPress plugin (bp-better-messages) at version 3.2.1 or older, where users can post messages that other users view. Sites without the plugin are not affected. The sources do not say which roles can submit the stored input.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["bpbettermessages"],"ptokens":["better","bp","messages"],"labels":["bpbettermessages","buddypress","medium","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-124257':13A,16A '-2026':12A,15A '3.2.1':10A 'better':2A,19A 'bp':1A,18A 'bp-better-messages':17A 'cve':11A,14A 'messag':3A 'messages':20A 'plugin':5A 'store':6A 'version':9A 'wordpress':4A 'xss':7A","search_b":"'attack':50B 'better':23B,29B 'bp':22B,28B 'bp-better-messag':21B 'browser':59B 'buddypress':25B,36B 'fail':37B 'input':40B 'later':45B 'messag':24B,30B,33B 'packag':26B 'page':48B 'plant':52B 'plugin':34B 'render':46B 'run':55B 'sanit':39B 'script':53B 'store':43B 'user':58B 'wordpress':27B,32B","search_c":"'3.2.1':93C 'affect':86C 'allow':82C 'better':76C,80C,88C 'bp':75C,79C,87C 'bp-better-messag':78C 'cross':69C 'cross-sit':68C 'generat':67C 'improp':60C 'input':63C 'issu':85C 'messag':77C,81C,89C 'n/a':91C 'neutral':61C 'page':66C 'script':71C 'site':70C 'store':83C 'vulner':72C 'web':65C 'wordplus':74C 'xss.this':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T10:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124257","severity":null,"published_at":"2026-11-11T10:16:43+00:00","modified_at":"2026-11-11T10:16:43+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","fetched_at":"2026-11-11T10:26:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}