Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

WordPlus vulnerabilities

23 published CVEs name WordPlus among the affected products.

All 23 in the listAtom feed of new CVEs
Published CVEs
23
Last 12 months
12
Critical
0
Known exploited
0

Critical 0High 7Medium 15Low 1Not scored 0

CVEs per yearBy the year they were published

  1. 20225
  2. 20231
  3. 20242
  4. 20254
  5. 202611

Newest CVEs

  • CVE-2026-114179

    WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

    wordplus · BP Better Messages

    High7.1
  • CVE-2026-94376

    Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name

    wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

    Medium6.4
  • CVE-2026-93899

    Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

    wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

    Medium6.5
  • CVE-2026-89093

    Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register

    wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

    Medium5.3
  • CVE-2026-89334

    Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint

    wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

    Medium6.5
  • CVE-2026-18555

    Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter

    wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

    Medium6.1
  • CVE-2026-84812

    WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

    wordplus · BP Better Messages

    High7.1
  • CVE-2026-32547

    WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability

    wordplus · BP Better Messages

    High7.1
  • CVE-2026-16585

    Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

    wordplus · Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

    High7.2
  • CVE-2026-42736

    WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability

    wordplus · BP Better Messages

    High7.5

Products with the most CVEs

  1. Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots6
  2. Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages6
  3. BP Better Messages5
  4. Better Messages (WordPress plugin)5
  5. Better Messages – Integration for WC Vendors Marketplace1
  6. Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss1
  7. Better Messages – WCFM Integration1

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)9
  2. CWE-862 Missing authorization3
  3. CWE-352 Cross-site request forgery (CSRF)2
  4. CWE-918 Server-side request forgery (SSRF)2
  5. CWE-200 Exposure of sensitive information1
  6. CWE-22 Path traversal1
  7. CWE-284 Improper access control1
  8. CWE-287 Improper authentication1
  9. CWE-400 Uncontrolled resource consumption1
  10. CWE-639 Authorization bypass through a user-controlled key (IDOR)1