CVE-2026-114179
Received Received - Intake

DOM-Based XSS in BP Better Messages WordPress Plugin

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-114179
EUVD
EUVD-2026-109245

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordplus BP Better Messages 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a DOM-based Cross-Site Scripting (XSS) vulnerability in the BP Better Messages plugin for WordPress. It occurs when user input is improperly neutralized during web page generation, allowing malicious scripts to execute in the context of a user's browser.

Detection Guidance

Since this is a DOM-based XSS vulnerability in the BP Better Messages WordPress plugin, detection requires checking for vulnerable versions of the plugin. Inspect your WordPress installation for the plugin and verify if the version is 3.1.3 or lower. Use commands like 'grep' to search for the plugin directory or check the WordPress admin panel for installed plugins.

Impact Analysis

An attacker could exploit this to steal sensitive user data like cookies or session tokens, perform actions on behalf of users, or deface websites. Users with admin access are particularly at risk if the plugin is active.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update the BP Better Messages plugin to the latest version, which should be above 3.1.3. If an update is not available, consider disabling or removing the plugin until a patch is released. Regularly monitor the plugin's official repository for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart