Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

23 results

Sep 25, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Stored DOM-Based Cross-Site ScriptingCVE-2026-94376 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc attribute), allowing the encoded string to be stored as a display name without requiring the unfiltered_html capability, and the plugin subsequently decodes it server-side before rendering.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Generic SQL InjectionCVE-2026-93899 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Authorization bypassCVE-2026-89334 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.33
What to do
Affects up to 2.15.33. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Information Exposure by SpoofingCVE-2026-89093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.33
What to do
Affects up to 2.15.33. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 16, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Reflected Cross-Site ScriptingCVE-2026-18555 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.22
What to do
Affects up to 2.15.22. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 28, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Arbitrary file deletionCVE-2026-16585 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.19
What to do
Affects up to 2.15.19. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2025ChatLuck contains a cross-site scripting vulnerability in Chat Rooms.CVE-2025-53858 · Other software · NEOJAPAN Inc. · reported by vultures@jpcert.or.jpMedium 4.8
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
Product
ChatLuck
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp chatluck.com
Jun 1, 2023A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress.CVE-2015-10110 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
Product
ruddernation TinyChat Room Spy
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update ruddernation TinyChat Room Spy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Mar 10, 2023An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the groupCVE-2023-23911 · Other software · Rocket.chat · reported by support@hackerone.comHigh 7.5
An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.
Product
Rocket.chat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackerone.com hackerone.com
Jun 22, 2022In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality.CVE-2022-23055 · Other software · frappe · reported by vulnerabilitylab@mend.ioMedium 5.5
In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.
Product
frappe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 22, 2021OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.CVE-2021-33494 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Nov 22, 2021OX App Suite 7.10.5 allows XSS via an OX Chat room name.CVE-2021-33492 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com open-xchange.com
Apr 26, 2019The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2019-0186 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
Product
Apache Pluto
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mail-archives.apache.org packetstormsecurity.com
Dec 17, 2015The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote atCVE-2015-8601 · Other software · Chat Room Project · reported by MITREMedium 5
The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
Product
Chat Room
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Jan 1, 2015Multiple cross-site scripting (XSS) vulnerabilities in TTChat 1.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the msg parameter to dCVE-2011-5297 · Other software · Ttfreeware · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in TTChat 1.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the msg parameter to default.php or (2) the username parameter to chat_form.php.
Product
Tigertoms Chat Room
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record htbridge.com htbridge.com
Oct 20, 2014Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HCVE-2014-5276 · Other software · Pro Chat Rooms · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via (1) an uploaded profile picture or (2) the edit parameter to profiles/index.php.
Product
Text Chat Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Oct 20, 2014Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SCVE-2014-5275 · Other software · Prochatrooms · reported by MITREMedium 6.5
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
Product
Text Chat Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com packetstormsecurity.com
Sep 19, 2014The ChatBox - Chat Rooms (aka com.droidchatroom.messengerapp) application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-CVE-2014-5958 · Other software · Chatbox · reported by cret@cert.orgMedium 5.4
The ChatBox - Chat Rooms (aka com.droidchatroom.messengerapp) application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Chatbox - Chat Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Mar 20, 2009Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a ..CVE-2008-6502 · Other software · Prochatrooms · reported by MITREMedium 4.6
Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. (dot dot) in the avatar parameter, and cause other users to execute this script by using sendData.php to send a message to (1) an individual user or (2) a room, leading to cross-site request forgery (CSRF), cross-site scripting (XSS), or other impacts.
Product
Pro Chat Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Mar 20, 2009Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the guCVE-2008-6501 · Other software · Prochatrooms · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the gud parameter.
Product
Pro Chat Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com
Nov 14, 2008SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud paCVE-2008-5070 · Other software · Pro Chat Rooms · reported by MITREHigh 7.5
SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud parameter to (1) profiles/index.php and (2) profiles/admin.php.
Product
Pro Chat Rooms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Feb 9, 2007Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspCVE-2007-0868 · Other software · Yahoo · reported by MITREMedium 5
Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
Messenger
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Nov 2, 2003Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room, as demonstrated usCVE-2003-1188 · Other software · Unichat · reported by MITREMedium 5
Unichat allows remote attackers to cause a denial of service (crash) by adding extra chat characters (avatars) and logging in to a chat room, as demonstrated using duplicate ACTOR entries in u2res000.rit.
Product
Unichat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com osvdb.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.