CVE-2025-43839: BP Messages Tool XSS Vulnerability

CVE-2025-43839 Overview

CVE-2025-43839 is a reflected cross-site scripting (XSS) vulnerability in the BP Messages Tool WordPress plugin developed by shanebp. The flaw affects all plugin versions up to and including 2.2. The plugin fails to properly neutralize user-supplied input before reflecting it back in generated web pages, allowing attackers to inject arbitrary JavaScript. Exploitation requires user interaction, typically through a crafted link delivered via phishing or social engineering. The issue is tracked under CWE-79 and was published to the National Vulnerability Database on May 19, 2025.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions on the affected WordPress site.

Affected Products

shanebp BP Messages Tool plugin for WordPress
BP Messages Tool versions through 2.2
WordPress sites integrating the bp-messages-tool plugin with BuddyPress

Discovery Timeline

2025-05-19 - CVE-2025-43839 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-43839

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation within the BP Messages Tool plugin. The plugin reflects attacker-controlled parameters into the rendered HTML response without applying output encoding or input sanitization. An attacker constructs a malicious URL containing JavaScript payloads as query parameters. When a logged-in administrator or user clicks the crafted link, the injected script executes in the browser under the origin of the vulnerable WordPress site. Because the vulnerability has a scope change component, the injected script can affect resources beyond the vulnerable component itself, including authenticated session tokens and DOM elements outside the plugin's direct scope.

Root Cause

The root cause is the absence of contextual output encoding when the plugin echoes request data back into HTTP responses. WordPress provides escaping functions such as esc_html(), esc_attr(), and esc_url(), but the affected code paths in bp-messages-tool do not apply them consistently before rendering user-controlled input.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL pointing to the vulnerable WordPress endpoint with a JavaScript payload embedded in a query parameter. The attacker delivers the link via email, chat, or a malicious referring site. When the target clicks the link, the server reflects the payload into the response, and the browser executes the script in the context of the WordPress site. See the Patchstack WordPress Vulnerability Report for technical details on the reflection point.

Detection Methods for CVE-2025-43839

Indicators of Compromise

Web server access logs containing requests to bp-messages-tool endpoints with URL-encoded <script>, onerror=, or javascript: payloads in query parameters
Outbound browser requests to attacker-controlled domains immediately following access to a BP Messages Tool URL
Unexpected administrative actions or new user accounts created shortly after an authenticated user visited a suspicious link

Detection Strategies

Inspect HTTP request logs for query string parameters containing HTML or JavaScript metacharacters such as <, >, ', ", and %3C
Deploy a web application firewall (WAF) ruleset that flags reflected XSS signatures targeting WordPress plugin paths
Correlate referrer headers with subsequent suspicious DOM-initiated requests in browser telemetry

Monitoring Recommendations

Monitor WordPress audit logs for privilege changes, plugin modifications, and unauthorized post or page edits
Alert on cookie theft patterns such as document.cookie exfiltration in browser-based telemetry
Track plugin inventory across all WordPress instances to identify hosts still running bp-messages-tool versions at or below 2.2

How to Mitigate CVE-2025-43839

Immediate Actions Required

Identify all WordPress installations running the BP Messages Tool plugin and confirm installed versions
Deactivate the bp-messages-tool plugin on affected sites until a fixed version is verified and installed
Educate administrators and privileged users to avoid clicking unsolicited links referencing the affected WordPress site

Patch Information

No official patched version beyond 2.2 is documented in the available advisory data. Site owners should monitor the Patchstack WordPress Vulnerability Report and the plugin's repository for an updated release that introduces proper input sanitization and output encoding.

Workarounds

Disable or uninstall the bp-messages-tool plugin until a vendor patch is available
Deploy WAF rules that block requests containing HTML or JavaScript payloads in query parameters targeting the plugin endpoints
Implement a strict Content Security Policy (CSP) header to limit execution of inline and untrusted scripts

bash

# Example nginx Content Security Policy header to limit XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;