CVE-2026-124257mediumCWE-79

CVE-2026-124257: medium-severity vulnerability in wordplus BP Better Messages

WordPress BP Better Messages plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Published

Follow this CVE+ Monitor BP Better Messages

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
wordplus · BP Better Messages
Related CVEs — wordplus BP Better Messages

In the same product, most dangerous first.

CVE-2026-42736HIGHWordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-84812HIGHWordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32547HIGHWordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-114179HIGHWordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%