CVE-2026-94376 in Better Messages Plugin
Summary
by MITRE • 09/25/2026
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Better Messages plugin for WordPress contains a critical security flaw classified as Stored DOM-Based Cross-Site Scripting within its chat room functionality. This vulnerability exists in all versions up to and including 3.0.4, stemming from insufficient input sanitization and output escaping mechanisms when handling user display names. The core issue lies in the interaction between how data is stored by WordPress core functions and how it is subsequently rendered by the plugin. Specifically, the function sanitize_text_field() preserves HTML-entity-encoded payloads rather than stripping them entirely or converting them to safe text. This behavior allows an attacker to store malicious scripts within a user profile field without triggering standard security filters that typically block raw script tags.
The operational impact of this vulnerability is severe because it requires only subscriber-level access, which is the lowest privilege level available in WordPress by default for registered users. An authenticated attacker with basic subscription rights can inject arbitrary web scripts into their display name. When other users view pages containing these chat rooms or group chats where the malicious display name is rendered, the browser decodes the HTML entities and executes the injected JavaScript code within the context of the victim's session. This execution occurs in the user's browser environment, enabling a wide range of attacks including session hijacking, credential theft via keyloggers, defacement of chat interfaces, or redirection to malicious phishing sites.
From an industry standards perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it represents a Stored XSS variant where the payload is persisted on the server and served to multiple victims over time. In terms of the MITRE ATT&CK framework for enterprise security, this exploitation technique maps to T1059: Command and Control via Web Protocols or potentially T1204: User Execution if it involves social engineering through chat messages. The persistence aspect makes it particularly dangerous as it does not require complex phishing links but rather relies on the victim simply viewing a page where their own malicious payload is displayed back to them by other users.
Mitigation strategies must address both the immediate exposure and the underlying architectural flaw. Administrators should immediately update the Better Messages plugin to version 3.0.5 or later, which resolves this issue through proper output escaping using functions like esc_html() or wp_kses_post() before rendering user-supplied data in HTML contexts. For sites unable to upgrade immediately, implementing a Web Application Firewall rule that detects and blocks common XSS payloads within display name fields can provide temporary protection. Additionally, enforcing stricter capabilities for users who wish to use rich text features may help reduce the attack surface, although this is less practical given the low privilege level required for exploitation in this specific case. Regular auditing of user-generated content stored in database fields against expected data types and formats remains a best practice to prevent such storage-based injection attacks.