Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Security & Risk Analysis

The bp-better-messages plugin, version 2.14.0, presents a mixed security posture. While it demonstrates good practices in SQL query handling, with 92% using prepared statements, and shows a reasonable number of capability checks, significant concerns arise from its attack surface and code analysis. A notable 16 out of 199 entry points are unprotected, including 7 AJAX handlers and 9 REST API routes without permission callbacks. The presence of dangerous functions like `shell_exec`, `assert`, and `unserialize` is also a red flag, as is the 70% rate of proper output escaping, leaving 30% potentially vulnerable to XSS. The taint analysis, while not revealing critical vulnerabilities, identified one flow with unsanitized paths, which warrants attention.

The plugin's vulnerability history is a significant concern, with a total of 13 known CVEs. Although none are currently unpatched, the high number of past high and medium severity vulnerabilities, including exposure of sensitive information, XSS, missing authorization, SSRF, and CSRF, indicates a recurring pattern of security weaknesses. The fact that the last reported vulnerability was as recent as December 2025 (although this date seems to be in the future and likely a typo in the source data, it still points to ongoing issues) further emphasizes the need for vigilance. The plugin's strengths lie in its SQL query practices and capability checks, but these are overshadowed by the large, partially unprotected attack surface, dangerous function usage, and a history of diverse and severe vulnerabilities.