CVE-2026-18555

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 2.15.23

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via the icn parameter, enabling the execution of arbitrary web scripts if a user is tricked into clicking a malicious link.

Recommendations Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to version 2.15.23 or later. Avoid using the icn parameter until the plugin is updated.