The Better Messages – Live Chat plugin is vulnerable to stored cross‑site scripting through the guest display name field. This weakness, identified as CWE‑79, allows an unauthenticated attacker to store malicious scripts that are later executed in the browsers of any user who views a page containing the injected data. The impact is client‑side code execution which may lead to session hijacking, defacement, or phishing attacks against site visitors.

The vulnerability affects the WordPress Better Messages – Live Chat, Chat Rooms, Real‑Time Messaging & Private Messages plugin provided by wordplus. All released versions up to and including 2.10.2 are impacted. Users of WordPress sites employing BuddyPress, PeepSo, Ultimate Member, or BuddyBoss that rely on this plugin must check the plugin version and ensure it is updated beyond 2.10.2.

The CVSS score of 6.1 indicates a medium severity threat. The EPSS score of less than 1% reflects a low probability of real‑world exploitation given the current data, and the vulnerability is not listed in the CISA KEV catalog. Unauthenticated attackers can exploit the flaw by creating a guest user with a crafted display name; when any site visitor views a page that displays that name, the injected script runs. This attack requires no special privileges and can affect all visitors to the page.