7.5Hoch

CVE-2024-13611Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Veröffentlicht: 2025-03-01 11:23 (vor 1 Jahr)

Beschreibung

The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.

Schwachstellentyp (CWE): CWE-200

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
wordplus	better messages	< 2.7.0
wordplus	Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages	≤ 2.6.9

Referenzen und Patches

CPE-Treffer (NVD) (1)

cpe:2.3:a:wordplus:better_messages:*:*:*:*:*:wordpress:*:* < 2.7.0

CVSS-Score

7.5Hoch

Quelle: Wordfence · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Keine
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Alle Scores (2)

cna	CVSS 3.1	7.5Hoch
security@wordfence.com	CVSS 3.1	7.5Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.50%

höher als 43 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2025-01-21
Veröffentlicht2025-03-01 11:23
Bei IP-DB eingegangen2026-10-24 23:54
Zuletzt aktualisiert2026-06-17 10:02

Vergeben von (CNA): Wordfence
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

8.8Hoch

CVE-2026-13764 vor 4 Stunden

Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

StylemixThemes Masterstudy - Education WordPress Theme

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJ…

8.8Hoch

CVE-2026-16135 vor 4 Stunden

VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()

VibeThemes VibeBP

The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possibl…

8.8Hoch

CVE-2026-15309 vor 4 Stunden

CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint

WishList Member CourseCure Courses

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update…

5.4Mittel

CVE-2026-2982 vor 4 Stunden

WP Table Builder – Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'

wptb WP Table Builder – Drag & Drop Table Builder

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possib…

8.8Hoch

CVE-2026-125836 vor 8 Stunden

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Nicu Micle Simple JWT Login

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

5.3Mittel

CVE-2026-124817 vor 10 Stunden

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.