PLUGIN SECURITY
Is Bp Better Messages safe?
Real-time messaging and chat rooms for WordPress ecosystem: private conversations, public and private chat rooms, video & audio calls, and more.
What this plugin does
- Slug:
bp-better-messages - Author: wordplus
- 10000+ active installs
- 96/100 rating (141 reviews on wordpress.org)
- 1839791 all-time downloads
- On WordPress.org since 2017-01-03
buddypresschat roomgroup chatprivate messagevideo chat
Maintenance status
- Latest known version: 2.15.24
- Last updated: 2026-08-31 4:40am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
18 known CVEs on file for Bp Better Messages. Reported between 2021 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-16585 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.15.20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.2 | < 2.15.20 | 2.15.20 | 2026-07-27 | ✓ fixed in latest |
| CVE-2026-32547 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.15.23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.15.23 | 2.15.23 | 2026-07-27 | ✓ fixed in latest |
| CVE-2026-42736 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.15.0 | — | High 7.5 | < 2.15.0 | 2.15.0 | 2026-05-27 | ✓ fixed in latest |
| CVE-2024-13362 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.7.0 | 2.7.0 | 2026-04-30 | ✓ fixed in latest |
| CVE-2025-14154 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.10.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.10.3 | 2.10.3 | 2025-12-16 | ✓ fixed in latest |
| CVE-2024-13611 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.0 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 2.7.0 | 2.7.0 | 2025-02-28 | ✓ fixed in latest |
| CVE-2024-13697 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.5 | Server-Side Request Forgery (SSRF) | Medium 4.8 | < 2.7.5 | 2.7.5 | 2025-02-28 | ✓ fixed in latest |
| CVE-2024-13612 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.7.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.7.0 | 2.7.0 | 2025-01-31 | ✓ fixed in latest |
+ 14 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-32802 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.4.33 | Missing Authorization | Medium 5.3 | < 2.4.33 | 2.4.33 | 2024-04-22 | ✓ fixed in latest |
| CVE-2023-49168 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.4.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.4.1 | 2.4.1 | 2023-11-29 | ✓ fixed in latest |
| CVE-2023-33999 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 2.1.21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.1.21 | 2.1.21 | 2023-07-18 | ✓ fixed in latest |
| CVE-2022-40216 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.10.71 | Improper Access Control | Medium 4.3 | < 1.9.10.71 | 1.9.10.71 | 2022-11-09 | ✓ fixed in latest |
| CVE-2022-41609 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.10.69 | Server-Side Request Forgery (SSRF) | Medium 6.4 | < 1.9.10.69 | 1.9.10.69 | 2022-10-21 | ✓ fixed in latest |
| CVE-2022-33142 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.10.58 | Uncontrolled Resource Consumption | High 7.7 | < 1.9.10.58 | 1.9.10.58 | 2022-08-22 | ✓ fixed in latest |
| — | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | Missing Authorization | Medium 6.3 | < 1.9.9.170 | 1.9.9.170 | 2022-03-04 | ✓ fixed in latest |
| — | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | — | Unknown | < 1.9.9.170 | 1.9.9.170 | 2022-02-28 | ✓ fixed in latest |
| — | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | — | Unknown | < 1.9.9.170 | 1.9.9.170 | 2022-02-28 | ✓ fixed in latest |
| CVE-2022-29454 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.149 | Cross-Site Request Forgery (CSRF) | Low 3.1 | < 1.9.9.149 | 1.9.9.149 | 2022-01-18 | ✓ fixed in latest |
| CVE-2022-36389 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.149 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.9.9.149 | 1.9.9.149 | 2022-01-18 | ✓ fixed in latest |
| CVE-2021-24808 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.9.9.170 | 1.9.9.170 | 2021-10-04 | ✓ fixed in latest |
| CVE-2021-24809 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages] < 1.9.9.170 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.9.9.170 | 1.9.9.170 | 2021-10-04 | ✓ fixed in latest |
| — | Unauthorised AJAX Calls via Freemius | — | Unknown | < 1.9.9.170 | 1.9.9.170 | — | ✓ fixed in latest |
How to fix it
Keep Bp Better Messages updated — 2.15.24 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- rtMedia for WordPress, BuddyPress and bbPress — 7000+ active installs — 74/100 (152) — max PHP <8.0
- BuddyPress Docs — 6000+ active installs — 88/100 (35) — max PHP 8.4
- WPML Multilingual for BuddyPress and BuddyBoss — 6000+ active installs — 92/100 (37) — max PHP 8.4
- BP Classic — 6000+ active installs
- Spam Destroyer — 5000+ active installs — 92/100 (54)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.