CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49168 – WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-49168
29 Nov 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPlus Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss allows Stored XSS.This issue affects Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss: from n/a through 2.4.0. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Coss-Site Scripting') en WordPlus Better Messages – Live Chat ... • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-bp-better-messages-plugin-2-3-12-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40216 – WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability
https://notcve.org/view.php?id=CVE-2022-40216
09 Nov 2022 — Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress. Vulnerabilidad de omisión de bloqueo de mensajería autenticada (con permisos de suscriptor o superiores) en el complemento Better Messages en versiones <= 1.9.10.69 en WordPress. The Better Messages plugin for WordPress is vulnerable to Authorization Bypass resulting in a block bypass on messaging controls in versions up to, and including, 1.9.10.68. This is due to insufficient or broken controls... • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-69-messaging-block-bypass-vulnerability?_s_id=cve • CWE-284: Improper Access Control CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41609 – WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-41609
21 Oct 2022 — Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. Vulnerabilidad de Server-Side Request Forgery (SSRF) autenticada (con privilegios de suscriptor o superior) en el complemento Better Messages 1.9.10.68 en WordPress. The Better Messages plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to 1.9.10.68. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to interact with... • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-68-server-side-request-forgery-ssrf-vulnerability?_s_id=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33142 – WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability
https://notcve.org/view.php?id=CVE-2022-33142
22 Aug 2022 — Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. Una vulnerabilidad de Denegación de Servicio (DoS) autenticado (subscriber+) en el plugin WordPlus WordPress Better Messages versiones anteriores a 1.9.10.57 incluyéndola, en WordPress. The Better Messages plugin for WordPress is vulnerable to Resource Exhaustion in versions up to, and including, 1.9.10.57 due to not limiting the size of individual messages. This allows a... • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-57-denial-of-service-dos-vulnerability • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36389 – WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-36389
18 Jan 2022 — Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin WordPlus Better Messages versiones anteriores a 1.9.9.148 incluyéndola, en WordPress. The Better Messages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.9.148. This is due to missing or incorrect nonce validation on the bp_messages_favorite action. This makes it possible ... • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability-2 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29454 – WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2022-29454
18 Jan 2022 — Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated. Una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en el plugin WordPlus Better Messages versiones anteriores a 1.9.9.148 incluyéndola, en WordPress permite a atacantes subir archivos. El archivo adjunto a los mensajes debe estar activado The Better Messages plugin for WordPress is vulnerable to Cross-Site Requ... • https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24808 – BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24808
04 Oct 2021 — The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue El plugin BP Better Messages de WordPress versiones anteriores a 1.9.9.41, sanea (con sanitize_text_field) pero no escapa el parámetro "subject" antes de devolverlo en un atributo, conllevando un problema de tipo Cross-Site Scripting Reflejado • https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/views/layout-new.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24809 – BP Better Messages < 1.9.9.41 - Multiple CSRF
https://notcve.org/view.php?id=CVE-2021-24809
04 Oct 2021 — The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions El plugin BP Better Messages de WordPress versiones anteriores a 1.9.9. 41 no comprueba el CSRF en varias... • https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/inc/ajax.php • CWE-352: Cross-Site Request Forgery (CSRF) •