CVE-2024-13612

Summary

CVE-2024-13612: The Better Messages plugin for WordPress, used with BuddyPress, PeepSo, Ultimate Member, and BuddyBoss, contains a Stored Cross-Site Scripting (XSS) vulnerability. Affecting versions up to 2.6.9, this issue stems from insufficient input sanitization and output escaping on user-supplied attributes in the 'better_messages_live_chat_button' shortcode. Consequently, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts, leading to the execution of malicious code whenever an affected user visits an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.