private messages vulnerabilities and fixes

Q: How do I fix private messages vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is private messages being exploited right now?

None of the tracked private messages CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which private messages CVE should I patch first?

CVE-2022-29442 currently ranks highest (31/100): Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For.

Recent CVEs affecting private messages, with upgrade or downgrade steps. 2 tracked.

Also searched as: privatemessages.

private messages has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-06-15. Highest priority: CVE-2022-29442 (score 31/100).

CVE-2022-29442 MEDIUM 5.4 UPGRADE Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For
CVE-2022-29441 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPres

FAQ

How do I fix private messages vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is private messages being exploited right now?

None of the tracked private messages CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which private messages CVE should I patch first?

CVE-2022-29442 currently ranks highest (31/100): Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For.

← Back to latest CVEs