CVE-2021-24809— BP Better Messages < 1.9.9.41 - Multiple CSRF
Quick assessment
Affected
Unknown BP Better Messages
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress插件 BP Better Messages 1.9.9.41之前版本存在跨站请求伪造漏洞，该漏洞源于插件对于其中的多个AJAX行为缺少有效的CSRF检查，这可能允许攻击者可利用该漏洞让登录的用户执行不需要的操作。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24809
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BP Better Messages < 1.9.9.41 - Multiple CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress插件 BP Better Messages 1.9.9.41之前版本存在跨站请求伪造漏洞，该漏洞源于插件对于其中的多个AJAX行为缺少有效的CSRF检查，这可能允许攻击者可利用该漏洞让登录的用户执行不需要的操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | BP Better Messages | 1.9.9.41 ~ 1.9.9.41 | - |
|
II. Public POCs for CVE-2021-24809
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24809
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-24809 (1)
Vendor Advisories for CVE-2021-24809 (1)
Same Patch Batch · Unknown · 2021-11-01 · 30 CVEs total
| CVE-2021-24716 | Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24813 | Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24808 | BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting | |
| CVE-2021-24799 | Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF | |
| CVE-2021-24794 | Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24793 | WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24789 | Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24781 | Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value Change | |
| CVE-2021-24773 | WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24770 | Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload | |
| CVE-2021-24757 | Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload | |
| CVE-2021-24742 | Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings Update | |
| CVE-2021-24723 | WP Reactions Lite < 1.3.6 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24722 | Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site Scripting | |
| CVE-2021-24717 | AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation | |
| CVE-2015-10001 | WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24715 | WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting | |
| CVE-2021-24685 | Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting | |
| CVE-2021-24682 | Cool Tag Cloud < 2.26 - Contributor+ Stored Cross-Site Scripting | |
| CVE-2021-24624 | MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: BP Better Messages
-
CVE-2026-84812
WordPress BP Better Messages plugin <= 2.15.27 - Cross Site -
CVE-2026-32547
WordPress BP Better Messages plugin <= 2.15.22 - Cross Site -
CVE-2026-42736
WordPress BP Better Messages plugin <= 2.14.16 - Insecure Di -
CVE-2024-32802
WordPress Better Messages plugin <= 2.4.32 - Broken Authenti -
CVE-2021-24808
BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripti
Same vendor: Unknown
-
CVE-2026-94256
SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via -
CVE-2026-94257
SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalati -
CVE-2026-87780
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthe -
CVE-2026-87781
LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - -
CVE-2026-85571
Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparen
Same weakness: CWE-352
-
CVE-2026-108553
OpenRefine through 3.10.1 CSRF to RCE via get-rows Command -
CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions -
CVE-2026-107809
Nginx-UI AuthRequired token cookie fallback enables CSRF aga -
CVE-2026-62026
WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Reque -
CVE-2026-96671
WordPress Featured Image from URL plugin <= 6.0.7 - Cross Si
V. Comments for CVE-2021-24809
No comments yet