CVE-2026-94376

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored DOM-Based Cross-Site Scripting. This occurs because the sanitize text field() function in WordPress core preserves HTML-entity-encoded payloads, such as an iframe srcdoc attribute. This allows an encoded string to be stored as a user display name without requiring the unfiltered html capability. The plugin then decodes this string server-side before rendering, enabling the execution of arbitrary web scripts when a user accesses the affected page.

Recommendations Update to a version newer than 3.0.4.