CVE-2026-94376 wordplus CVE debrief

Who should care

WordPress administrators and defenders responsible for maintaining the security of WordPress installations using the Better Messages plugin should assess exposure and prioritize patching or mitigation efforts.

Why it matters

CVE-2026-94376 is a Stored DOM-Based Cross-Site Scripting vulnerability in the Better Messages plugin for WordPress. Defenders should prioritize patching, restrict user access, and monitor for suspicious activity to mitigate potential risks.

• Attackers can inject malicious scripts, potentially leading to user session hijacking or unauthorized actions.
• The vulnerability can be exploited by authenticated users with subscriber-level access, increasing the attack surface.
• Successful exploitation requires user interaction, as scripts execute when a user accesses an injected page.
• Defenders need to verify the plugin version and user access levels to assess exposure.

Technical summary

The Better Messages plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4. This is due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability's technical impact is heightened by the fact that WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads, allowing attackers to store and execute malicious scripts.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations with subscriber-level user access.

Recommended defensive actions

• Patch or upgrade the Better Messages plugin to a version beyond 3.0.4.
• Restrict subscriber-level user access to sensitive areas of the WordPress installation.
• Monitor for suspicious activity or injected scripts on the WordPress site.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in plugin versions up to 3.0.4. The CVE and NVD records provide details on the vulnerability's impact and affected versions. Defenders should verify the plugin version and user access levels to assess exposure. Evidence limits are based on CVE and NVD records, and further verification is recommended. The Better Messages plugin's vulnerability is exploitable due to the preservation of HTML-entity-encoded payloads by WordPress core's sanitize_text_field(), allowing the encoded string to be stored as a and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.