CVE-2026-94376Published
Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94376 · Microsoft / collected KEV context
cve-program · CVE-2026-94376
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f5a268-7e7f-4dbe-823a-a17ac0f52928?source=cve
- https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/functions.php#L2276
- https://plugins.trac.wordpress.org/browser/bp-better-messages/tags/3.0.3/inc/functions.php#L1117
- https://plugins.trac.wordpress.org/changeset?old_path=bp-better-messages%2Ftags%2F3.0.3%2Faddons%2Fbuddyboss.php&new_path=bp-better-messages%2Ftags%2F3.0.5%2Faddons%2Fbuddyboss.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.