Medium
CVE-2026-94376
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 25
Reset filters
Medium
CVE-2026-93899
Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
Medium
CVE-2026-89093
Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register
Medium
CVE-2026-89334
Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint
Medium
CVE-2026-18555
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter
High
CVE-2026-84812
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-32547
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-16585
Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter
Medium
CVE-2026-42736
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.14.16 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Medium
CVE-2025-14154
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2024-13611
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2024-13697
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links
Medium
CVE-2024-13612
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-32802
BP Better Messages <= 2.4.32 - Missing Authorization
Medium
CVE-2023-49168
BP Better Messages <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Medium
CVE-2023-33999
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
Medium
CVE-2022-40216
Better Messages <= 1.9.10.68 - Authorization Bypass to Blocking Control Bypass
High
CVE-2022-41609
Better Messages <= 1.9.10.68 - Server-Side Request Forgery
High
CVE-2022-33142
Better Messages <= 1.9.10.57 - Resource Exhaustion
Medium
CVE-2022-4974
Freemius SDK <= 2.4.2 - Missing Authorization Checks
High
CVE-2022-29454
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery
High
CVE-2022-36389
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery
High
CVE-2021-24809
BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.