WordPlus vulnerabilities
We track 4 vulnerabilities in WordPlus products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2026.
Latest WordPlus vulnerabilities
- 7.1 High severity
BP Better Messages: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.
- 7.2 High severity
Better Messages – Chat Rooms, Group Chat…: Improper Limitation of a Pathname to a Restricted Directory
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. T
- 7.5 High severity
BP Better Messages: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through <= 2.14.16.
- 7.5 High severity
Better Messages – Live Chat, Chat Rooms…: Exposure of Sensitive Information to an Unauthorized Actor
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it