wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages version is affected

Latest wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages vulnerabilities

CVE-2024-13362 — Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
CVE-2025-14154 — Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
CVE-2024-13697 — Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links (CVSS 6.5)
CVE-2024-13611 — Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (CVSS 7.5)
CVE-2024-13612 — Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
CVE-2023-49168 — WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
CVE-2022-41609 — WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability (CVSS 8.8)
CVE-2022-40216 — WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability (CVSS 6.5)
CVE-2022-36389 — WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
CVE-2022-33142 — WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability (CVSS 6.5)
CVE-2022-29454 — WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
CVE-2021-24809 — BP Better Messages < 1.9.9.41 - Multiple CSRF (CVSS 8.8)
CVE-2021-24808 — BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting (CVSS 6.1)