CVE-2026-94376: Better Messages WordPress Plugin XSS Flaw

CVE-2026-94376 Overview

CVE-2026-94376 affects the Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress. The flaw is a Stored DOM-Based Cross-Site Scripting [CWE-79] vulnerability triggered through the User Display Name field. All plugin versions up to and including 3.0.4 are affected due to insufficient input sanitization and output escaping. Authenticated users with Subscriber-level access or higher can inject arbitrary web scripts that execute when other users render affected pages.

Critical Impact
Low-privileged Subscriber accounts can store JavaScript payloads that execute in the browsers of other site users, enabling session theft, account takeover, and administrative compromise through social engineering of higher-privileged victims.

Affected Products

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress
All versions up to and including 3.0.3
Version 3.0.4 (also affected per advisory)

Discovery Timeline

2026-09-25 - CVE-2026-94376 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-94376

Vulnerability Analysis

The vulnerability stems from a mismatch between WordPress core sanitization and how the Better Messages plugin later renders user-controlled data. WordPress exposes sanitize_text_field() to clean strings submitted during profile updates. This function strips tags but preserves HTML-entity-encoded content. An attacker with Subscriber privileges can submit an entity-encoded payload, such as an iframe with an srcdoc attribute, as their Display Name. The payload survives sanitization because the raw characters are already encoded and look benign.

The plugin then reads this stored display name in inc/functions.php and decodes the HTML entities server-side before injecting the value into page output. Once decoded, the payload becomes executable markup rendered in the DOM of any user viewing a page containing the attacker's name, including administrators viewing chat threads or user lists.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin trusts that data stored by WordPress core sanitization is safe to render after entity decoding. This assumption is incorrect because sanitize_text_field() is not a context-aware output escape and does not prevent payloads that regain executable form after decoding. The affected code paths are referenced at inc/functions.php lines 1117 and 2276 in tag 3.0.3.

Attack Vector

An attacker registers or uses an existing Subscriber account on a WordPress site running the vulnerable plugin. The attacker updates their profile Display Name with an HTML-entity-encoded script payload. The encoded string passes sanitize_text_field() and is stored in the database as the user's display name. When any site user, including administrators, views a page where the attacker's display name is rendered by the plugin, the stored string is HTML-decoded and inserted into the DOM. The resulting markup executes in the victim's browser session, enabling cookie theft, forced actions through the WordPress REST API, or injection of further payloads.

See the Wordfence Vulnerability Report and the WordPress Plugin Code Review Line 1117 for the vulnerable rendering paths.

Detection Methods for CVE-2026-94376

Indicators of Compromise

User profile Display Name fields containing HTML entity sequences such as <iframe, <script, or < patterns that decode to executable tags.
Database rows in wp_users or user meta where display_name includes encoded srcdoc, onerror, or onload attributes.
Unexpected outbound requests originating from administrator browser sessions after viewing user lists, chat rooms, or private message threads.
New administrator accounts, plugin installations, or option changes correlating with Subscriber account registrations.

Detection Strategies

Audit wp_users.display_name and related user meta for entity-encoded HTML sequences using targeted SQL queries.
Deploy a web application firewall rule that inspects profile update requests to /wp-admin/profile.php and the plugin REST endpoints for entity-encoded tag patterns.
Review WordPress audit logs for Subscriber-level accounts that modified display names shortly before administrative session anomalies.
Monitor browser Content Security Policy violation reports for inline script execution originating from plugin-rendered pages.

Monitoring Recommendations

Enable verbose logging on user profile modifications and REST API users endpoints.
Correlate authenticated low-privilege activity with subsequent high-privilege actions in the same session timeframe.
Alert on creation of WordPress administrator accounts, API key generation, or plugin installation events outside of change windows.

How to Mitigate CVE-2026-94376

Immediate Actions Required

Update the Better Messages plugin to version 3.0.5 or later on all WordPress instances where it is installed.
Review all existing user accounts and sanitize or reset any Display Name values that contain HTML entity sequences.
Rotate administrator session cookies and credentials if entity-encoded payloads are found in stored user data.
Restrict new user registration to trusted sources until patching is confirmed.

Patch Information

The vendor addressed the issue in version 3.0.5. The code changes are documented in the WordPress Plugin Change Log 3.0.5. Administrators should apply the update through the WordPress plugin manager and verify the installed version matches 3.0.5 or later.

Workarounds

Disable the Better Messages plugin until the patch is applied if immediate update is not possible.
Temporarily disable open user registration or require administrator approval for new accounts to limit Subscriber-tier attackers.
Deploy a web application firewall rule that blocks HTML-entity-encoded script and iframe patterns in profile and messaging endpoints.
Enforce a strict Content Security Policy that disallows inline script execution and iframe srcdoc content on authenticated pages.

bash

# Verify installed plugin version via WP-CLI
wp plugin get bp-better-messages --field=version

# Update to the patched release
wp plugin update bp-better-messages --version=3.0.5

# Audit display names for entity-encoded payloads
wp db query "SELECT ID, user_login, display_name FROM wp_users \
  WHERE display_name REGEXP '&(lt|gt|#x?[0-9a-fA-F]+);';"