Known vulnerabilities in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

Real-time messaging and chat rooms for WordPress ecosystem: private conversations, public and private chat rooms, video & audio calls, and more.

22Reported vulnerabilities

8.8Highest CVSS score

2.15.27Latest version

10,000+Active installs

What to do now

Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to 3.0.5 or later. 22 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 15, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-24809	High 8.8	0.7%	Before 1.9.9.41	`1.9.9.41`	November 1, 2021
CVE-2021-24808	Medium 6.1	0.9%	Before 1.9.9.41	`1.9.9.41`	November 1, 2021
CVE-2022-41609	High 8.8	0.6%	Before 1.9.10.69	`1.9.10.69`	November 19, 2022
CVE-2022-36389	High 8.8	0.4%	1.9.9.148 and earlier	`1.9.9.149`	August 23, 2022
CVE-2026-16585	High 7.2	1.2%	0 to 2.15.19 (inclusive)	`2.15.20`	July 28, 2026
CVE-2024-13611	High 7.5	0.5%	Before 2.7.0	`2.7.0`	March 1, 2025
CVE-2026-84812	High 7.2	0.3%	2.15.27 and earlier	`2.15.28`	September 2, 2026
CVE-2026-32547	High 7.2	0.3%	2.15.22 and earlier	`2.15.23`	August 18, 2026
CVE-2022-33142	Medium 6.5	1.1%	Before 1.9.10.58	`1.9.10.58`	August 23, 2022
CVE-2026-89334	Medium 6.5	0.7%	0 to 2.15.33 (inclusive)	`3.0.0`	September 19, 2026
CVE-2026-93899	Medium 6.5	0.3%	0 to 3.0.4 (inclusive)	`3.0.5`	September 25, 2026
CVE-2024-13697	Medium 6.5	0.3%	Before 2.7.5	`2.7.5`	March 1, 2025
CVE-2022-40216	Medium 6.5	0.5%	Before 1.9.10.71	`1.9.10.71`	November 18, 2022
CVE-2026-94376	Medium 6.4	0.2%	0 to 3.0.4 (inclusive)	`3.0.5`	September 25, 2026
CVE-2026-18555	Medium 6.1	0.2%	0 to 2.15.22 (inclusive)	`2.15.23`	September 16, 2026
CVE-2025-14154	Medium 6.1	0.2%	0 to 2.10.2 (inclusive)	`2.10.3`	December 17, 2025
CVE-2026-89093	Medium 5.3	0.6%	0 to 2.15.33 (inclusive)	`3.0.0`	September 19, 2026
CVE-2024-13612	Medium 5.4	0.3%	Before 2.7.0	`2.7.0`	February 1, 2025
CVE-2023-49168	Medium 5.4	0.4%	Before 2.4.1	`2.4.1`	December 14, 2023
CVE-2026-42736	Medium 5.3	0.4%	2.14.16 and earlier	`2.15.0`	May 27, 2026
CVE-2024-32802	Medium 5.3	0.3%	2.4.32 and earlier	`2.4.33`	April 22, 2024
CVE-2022-29454	Medium 4.3	0.3%	Before 1.9.9.149	`1.9.9.149`	July 20, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.