Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

WordPlus — Vulnerabilities & Security Advisories 20

Browse all 20 CVE security advisories affecting WordPlus. AI-powered Chinese analysis, POCs, and references for each vulnerability.

WordPlus is a document processing software primarily used for creating, editing, and managing text-based files with advanced formatting capabilities. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, accounting for its 11 recorded CVEs. The application's complex macro system and extensive plugin architecture have frequently introduced security risks, allowing attackers to execute arbitrary code through malicious document attachments. While no major public security incidents have been widely documented, the consistent pattern of vulnerabilities across multiple versions suggests ongoing challenges in secure development practices, particularly regarding input validation and sandboxing of untrusted content.

CVE ID Title CVSS Severity Published
CVE-2026-94376 Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots CWE-79 6.4 Medium 2026-09-25
CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots CWE-89 6.5 Medium 2026-09-25
CVE-2026-89093 Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots CWE-287 5.3 Medium 2026-09-19
CVE-2026-89334 Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots CWE-862 6.5 Medium 2026-09-19
CVE-2026-18555 Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots CWE-79 6.1 Medium 2026-09-16
CVE-2026-84812 WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability — BP Better Messages CWE-79 7.1 High 2026-09-03
CVE-2026-32547 WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability — BP Better Messages CWE-79 7.1 High 2026-08-18
CVE-2026-16585 Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter — Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots CWE-22 7.2 High 2026-07-28
CVE-2026-42736 WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability — BP Better Messages CWE-639 7.5 High 2026-05-27
CVE-2025-14154 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting — Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages CWE-79 6.1 Medium 2025-12-17
CVE-2024-13697 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links — Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages CWE-918 4.8 Medium 2025-03-01
CVE-2024-13611 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory — Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages CWE-200 7.5 High 2025-03-01
CVE-2024-13612 Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode — Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages CWE-79 6.4 Medium 2025-02-01
CVE-2024-32802 WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability — BP Better Messages CWE-862 5.3 Medium 2024-05-17
CVE-2023-49168 WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS) — Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss CWE-79 6.5 Medium 2023-12-14
CVE-2022-41609 WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability — Better Messages (WordPress plugin) CWE-918 6.4 Medium 2022-11-18
CVE-2022-40216 WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability — Better Messages (WordPress plugin) 4.3 Medium 2022-11-18
CVE-2022-36389 WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability — Better Messages (WordPress plugin) CWE-352 4.3 Medium 2022-08-23
CVE-2022-33142 WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerability — Better Messages (WordPress plugin) 7.7 High 2022-08-23
CVE-2022-29454 WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability — Better Messages (WordPress plugin) CWE-352 3.1 Low 2022-07-20

This page lists every published CVE security advisory associated with WordPlus. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.