PT-2025-51814 · WordPress · Better Messages – Live Chat For Wordpress

D.Sim · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-14154

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress versions up to and including 2.10.2

Description The software is susceptible to a Stored Cross-Site Scripting issue due to inadequate input sanitization and output escaping. Specifically, the guest display name field is not properly validated, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts will execute when a user accesses an injected page.

Recommendations Update The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress to a version later than 2.10.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14154

Affected Products

Better Messages – Live Chat For Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14154 · Security Note
• https://plugins.trac.wordpress.org/changeset/3420771/bp-better-messages/trunk/inc/guests.php · Note
• https://t.me/CVEtracker/40035 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d68bbf0d-72e9-4295-a1e1-4abeb36cae1b?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2001183490990076217 · Twitter Post
• https://twitter.com/CVEnew/status/2001350822471569724 · Twitter Post
• https://t.me/cveNotify/146057 · Telegram Post