# CVE-2026-32547: BP Better Messages unauthenticated cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-32547-bp-better-messages-unauthenticated-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32547 · Severity: high · CVSS 7.1 · Published 2026-08-18

BP Better Messages is a WordPress plugin that enables messaging functionality for users on WordPress sites. A vulnerability in versions 2.15.22 and earlier allows unauthenticated attackers to inject malicious JavaScript code into pages, which can steal visitor data, hijack user accounts, or redirect users to malicious sites. The attack requires a privileged user to perform an action (such as clicking a malicious link), but the attacker themselves does not need authentication to exploit it.

Vendors: [BuddyBoss](https://junglewise.ai/threats/vendors/buddyboss).

## Quick answers

**Is CVE-2026-32547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32547 being exploited in the wild.

**How severe is CVE-2026-32547?** High severity, with a CVSS score of 7.1, published 18 August 2026.

**Which products and versions are affected?** BuddyBoss BP Better Messages <= 2.15.22.

**Is there a fix for CVE-2026-32547?** A patch was published on 2026-08-18: Version 2.15.23 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32547 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-32547?** Check whether you run BuddyBoss BP Better Messages at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin contains a reflected or stored cross-site scripting (XSS) vulnerability that allows injection of malicious scripts without authentication. While the attack vector is network-based and requires user interaction (a victim must click a malicious link or visit a crafted page), no authentication is required on the attacker's side. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable website, leading to credential theft, session hijacking, or malware distribution. The vulnerability has been patched in version 2.15.23 and later.

## Affected products

- BuddyBoss BP Better Messages <= 2.15.22

## Timeline

- 2026-08-18: disclosed
- 2026-08-18: patched: Version 2.15.23 or later

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/bp-better-messages/vulnerability/wordpress-bp-better-messages-plugin-2-15-22-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/bp-better-messages/vulnerability/wordpress-bp-better-messages-plugin-2-15-22-cross-site-scripting-xss-vulnerability?_s_id=cve)