SEGURIDAD DE PLUGINS
Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Bp Better Messages — verificado contra la base de datos de seguridad local de WP Clinic.
bp-better-messagesbuddypresschat roomgroup chatprivate messagevideo chat
16 CVEs conocidos registrados para Bp Better Messages. Reportadas entre 2021 y 2026.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-42736 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.15.0 | — | Alta 7,5 | < 2.15.0 | 2.15.0 | 2026-05-27 | — |
| CVE-2024-13362 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.7.0 | 2.7.0 | 2026-04-30 | — |
| CVE-2025-14154 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.10.3 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.10.3 | 2.10.3 | 2025-12-16 | — |
| CVE-2024-13611 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.0 | Exposición de información sensible a un actor no autorizado | Alta 7,5 | < 2.7.0 | 2.7.0 | 2025-02-28 | — |
| CVE-2024-13697 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.5 | Falsificación de petición del lado del servidor (SSRF) | Media 4,8 | < 2.7.5 | 2.7.5 | 2025-02-28 | — |
| CVE-2024-13612 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.7.0 | 2.7.0 | 2025-01-31 | — |
| CVE-2024-32802 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.4.33 | Falta de control de autorización | Media 5,3 | < 2.4.33 | 2.4.33 | 2024-04-22 | — |
| CVE-2023-49168 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.4.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,5 | < 2.4.1 | 2.4.1 | 2023-11-29 | — |
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.14.16 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'better_messages_live_chat_button' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.4.32. This is due to the plugin not properly verifying if a user should have access to a chatoom. This makes it possible for unauthenticated attackers to access chat rooms they should not have access to.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2023-33999 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.1.21 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Alta 7,1 | < 2.1.21 | 2.1.21 | 2023-07-18 | — |
| CVE-2022-40216 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.10.71 | Control de acceso incorrecto | Media 4,3 | < 1.9.10.71 | 1.9.10.71 | 2022-11-09 | — |
| CVE-2022-41609 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.10.69 | Falsificación de petición del lado del servidor (SSRF) | Media 6,4 | < 1.9.10.69 | 1.9.10.69 | 2022-10-21 | — |
| CVE-2022-33142 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.10.58 | Consumo de recursos no controlado | Alta 7,7 | < 1.9.10.58 | 1.9.10.58 | 2022-08-22 | — |
| — | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | Falta de control de autorización | Media 6,3 | < 1.9.9.170 | 1.9.9.170 | 2022-03-04 | — |
| — | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | — | Desconocido | < 1.9.9.170 | 1.9.9.170 | 2022-02-28 | — |
| — | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | — | Desconocido | < 1.9.9.170 | 1.9.9.170 | 2022-02-28 | — |
| CVE-2022-29454 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.149 | Falsificación de petición en sitios cruzados (CSRF) | Baja 3,1 | < 1.9.9.149 | 1.9.9.149 | 2022-01-18 | — |
| CVE-2022-36389 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.149 | Falsificación de petición en sitios cruzados (CSRF) | Media 4,3 | < 1.9.9.149 | 1.9.9.149 | 2022-01-18 | — |
| CVE-2021-24808 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 1.9.9.170 | 1.9.9.170 | 2021-10-04 | — |
| CVE-2021-24809 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | Falsificación de petición en sitios cruzados (CSRF) | Alta 8,8 | < 1.9.9.170 | 1.9.9.170 | 2021-10-04 | — |
Update the plugin to the latest version. Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress BP Better Messages Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.1.21.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The Better Messages plugin for WordPress is vulnerable to Authorization Bypass resulting in a block bypass on messaging controls in versions up to, and including, 1.9.10.68. This is due to insufficient or broken controls in the plugin. This makes it possible for subscriber-level attackers to bypass messaging blocks.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Better Messages plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to 1.9.10.68. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to interact with internal network hosts via specially crafted requests and can lead to sensitive information disclosure..
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Better Messages plugin for WordPress is vulnerable to Resource Exhaustion in versions up to, and including, 1.9.10.57 due to not limiting the size of individual messages. This allows attackers, with subscriber-level access or higher, to exhaust resources on the target server potentially resulting in Denial of Service.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Wordfence
Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress BP Better Messages plugin (versions < 1.9.9.170).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Sensitive Information Disclosure vulnerability discovered in WordPress BP Better Messages plugin (versions < 1.9.9.170).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress Better Messages plugin to the latest available version (at least 1.9.9.149). Brandon Roldan discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress BP Better Messages Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.9.9.149.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
Update the WordPress BP Better Messages plugin to the latest available version (at least 1.9.9.149). Vlad Vector discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress BP Better Messages Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.9.9.149.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: Patchstack
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente: CVE.org
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.