Plugin icon

Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages

bp-better-messages

Vulnerabilities:

15

Last Updated:

April 3, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2025-12-16
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.10.3 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.10.3
CVSS
6.1 (medium)
Published
2025-02-28
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.0 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Fixed in
Fixed in 2.7.0
CVSS
7.5 (high)
Published
2025-02-28
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.5 - Unauthenticated Limited Server-Side Request Forgery in nice_links
Fixed in
Fixed in 2.7.5
CVSS
4.8 (medium)
Published
2025-01-31
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 2.7.0
CVSS
6.4 (medium)
Published
2024-04-22
Title
BP Better Messages < 2.4.33 - Missing Authorization
Fixed in
Fixed in 2.4.33
CVSS
5.3 (medium)
Published
2023-11-29
Title
BP Better Messages < 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Fixed in
Fixed in 2.4.1
CVSS
6.4 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.1.18
CVSS
6.1 (medium)
Published
2022-11-09
Title
Better Messages < 1.9.10.71 - Subscriber+ Messaging Block Bypass
Fixed in
Fixed in 1.9.10.71
CVSS
4.3 (medium)
Published
2022-10-21
Title
Better Messages < 1.9.10.69 - Subscriber+ SSRF
Fixed in
Fixed in 1.9.10.69
CVSS
4.9 (medium)
Published
2022-08-22
Title
Better Messages < 1.9.10.58 - Subscriber+ Denial Of Service
Fixed in
Fixed in 1.9.10.58
CVSS
6.5 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 1.9.9.170
CVSS
4.3 (medium)
Published
2022-01-18
Title
Better Messages < 1.9.9.149 - File Upload via CSRF
Fixed in
Fixed in 1.9.9.149
CVSS
3.1 (low)
Published
2022-01-18
Title
Better Messages < 1.9.9.149 - Cross-Site Request Forgery
Fixed in
Fixed in 1.9.9.149
CVSS
4.3 (medium)
Published
2021-10-04
Title
BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.9.9.41
CVSS
8.8 (high)
Published
2021-10-04
Title
BP Better Messages < 1.9.9.41 - Multiple CSRF
Fixed in
Fixed in 1.9.9.41
CVSS
5.4 (medium)