These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross-site Scripting vulnerability exists in the BP Better Messages plugin for WordPress, affecting versions from n/a through 3.1.3. This issue allows for DOM-Based XSS. The vulnerability is particularly concerning as it can lead to potential XSS attacks against users of the plugin. Defenders should verify exposure and apply patches or mitigations to prevent potential attacks. The CVE record and NVD ent [truncated]
The Better Messages plugin for WordPress has a Stored DOM-Based Cross-Site Scripting vulnerability via User Display Name in versions up to 3.0.4. This vulnerability allows authenticated attackers with subscriber-level access to inject web scripts, which execute when a user accesses an injected page. The vulnerability is due to insufficient input sanitization and output escaping. Defenders should assess ex [truncated]
The Better Messages plugin for WordPress has a SQL injection vulnerability via the 'group_id' Message Meta Parameter in versions up to 3.0.4. This vulnerability allows authenticated attackers with subscriber-level access to append SQL queries and extract sensitive database information. The exploitation of this vulnerability requires the BuddyBoss Platform plugin with its Social Groups component disabled. [truncated]
The Better Messages plugin for WordPress has a reflected XSS vulnerability via the 'icn' parameter in versions up to 2.15.22. This allows unauthenticated attackers to inject web scripts if they can trick a user into clicking a link. The vulnerability has a CVSS score of 6.1 and a severity of MEDIUM. Defenders should prioritize verifying exposure of Better Messages plugin versions up to 2.15.22 and assess [truncated]