An improper neutralization of input during web page generation in the WordPress BP Better Messages plugin allows an attacker to inject malicious script code via user‑supplied data. The flaw is a DOM‑based XSS vulnerability (CWE‑79) that can execute arbitrary JavaScript in the victim’s browser when the content generated by the plugin is rendered.

All installations of the WordPress BP Better Messages plugin up to and including version 3.1.3 are affected. Any WordPress site that has this plugin version is vulnerable until the plugin is upgraded.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, so the likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation through malicious input or crafted URLs that cause the plugin to render user data without proper encoding, leading to client‑side script execution.