CVE-2025-14154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14154", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-05T19:58:21.755Z", "datePublished": "2025-12-17T05:24:55.217Z", "dateUpdated": "2026-04-08T17:26:23.481Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:23.481Z"}, "affected": [{"vendor": "wordplus", "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging & Private Messages", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.10.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d68bbf0d-72e9-4295-a1e1-4abeb36cae1b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3420771/bp-better-messages/trunk/inc/guests.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-12-08T20:35:34.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-16T17:20:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-17T19:13:00.515539Z", "id": "CVE-2025-14154", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T19:22:36.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T19:13:00.515539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T19:13:10.102Z"}}], "cna": {"title": "Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wordplus", "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging & Private Messages", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.10.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-08T20:35:34.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-16T17:20:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d68bbf0d-72e9-4295-a1e1-4abeb36cae1b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3420771/bp-better-messages/trunk/inc/guests.php"}], "descriptions": [{"lang": "en", "value": "The Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:23.481Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14154", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:26:23.481Z", "dateReserved": "2025-12-05T19:58:21.755Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-17T05:24:55.217Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Better Messages \u2013 Live Chat, Chat Rooms, Real-Time Messaging & Private Messages", "vendor": "wordplus", "versions": [{"lessThanOrEqual": "2.10.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via guest display name in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-14154", "lastModified": "2026-06-17T08:35:25.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14154", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-17T19:13:00.515539Z", "version": "2.0.3"}}]}, "published": "2025-12-17T06:15:41.747", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3420771/bp-better-messages/trunk/inc/guests.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d68bbf0d-72e9-4295-a1e1-4abeb36cae1b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:23:09.820941+00:00", "value": {"mitigation_remediation": ["Update the Better Messages plugin to the latest version available, which removes the input sanitization flaw in guest display names.", "If a patch is not yet available or an upgrade is not possible, disable or uninstall the plugin, or block guest users from submitting display names to prevent the stored script from being added.", "Ensure that any remaining guest display names are manually reviewed and sanitized before being displayed, or configure the plugin to escape output of all user\u2011supplied fields."], "summary": {"action": "Immediate Update", "impact": "Client\u2011Side Script Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress Better Messages \u2013 Live Chat, Chat Rooms, Real\u2011Time Messaging & Private Messages plugin provided by wordplus. All released versions up to and including 2.10.2 are impacted. Users of WordPress sites employing BuddyPress, PeepSo, Ultimate Member, or BuddyBoss that rely on this plugin must check the plugin version and ensure it is updated beyond 2.10.2.", "description_and_impact": "The Better Messages \u2013 Live Chat plugin is vulnerable to stored cross\u2011site scripting through the guest display name field. This weakness, identified as CWE\u201179, allows an unauthenticated attacker to store malicious scripts that are later executed in the browsers of any user who views a page containing the injected data. The impact is client\u2011side code execution which may lead to session hijacking, defacement, or phishing attacks against site visitors.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a medium severity threat. The EPSS score of less than 1% reflects a low probability of real\u2011world exploitation given the current data, and the vulnerability is not listed in the CISA KEV catalog. Unauthenticated attackers can exploit the flaw by creating a guest user with a crafted display name; when any site visitor views a page that displays that name, the injected script runs. This attack requires no special privileges and can affect all visitors to the page."}}}}, "created": "2025-12-17T14:28:33.987111+00:00", "updated": "2026-04-20T21:30:18.575242+00:00", "vendors": ["wordplus", "wordplus$PRODUCT$better_messages", "wordpress", "wordpress$PRODUCT$wordpress"]}