CVE-2025-14154

Name of the Vulnerable Software and Affected Versions The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress versions up to and including 2.10.2

Description The software is susceptible to a Stored Cross-Site Scripting issue due to inadequate input sanitization and output escaping. Specifically, the guest display name field is not properly validated, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts will execute when a user accesses an injected page.

Recommendations Update The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress to a version later than 2.10.2.