{
 "id": "WPSEC-2026-1325",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1325/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1325/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1325/index.md",
 "title": "Better Messages <= 3.1.3 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'bmErrors' Parameter",
 "description": "The Better Messages plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'bmErrors' URL parameter in all versions up to, and including, 3.1.3, due to insufficient sanitization and escaping. The messenger script reads error messages from the 'bmErrors' parameter in the query string or URL hash and parses them as HTML in an error notice. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user, such as an administrator, into clicking a crafted link to a page that loads the messenger.",
 "plugin": {
  "slug": "bp-better-messages",
  "name": "Better Messages",
  "full_name": "Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots",
  "wordpress_org": "https://wordpress.org/plugins/bp-better-messages/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bp-better-messages/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bp-better-messages"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.4",
 "remediation": "Update to 3.1.4 or later.",
 "fix_released": "2026-10-20T08:22:42+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:36:32.070316+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1325/",
  "https://plugins.svn.wordpress.org/bp-better-messages/tags/3.1.4/",
  "https://wordpress.org/plugins/bp-better-messages/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bp-better-messages",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}