CVE-2026-94376 is a stored DOM-based cross-site scripting vulnerability in the Better Messages WordPress plugin (versions <=3.0.4). Authenticated users with subscriber-level privileges can inject arbitrary web scripts through their display name because the plugin fails to properly sanitize and escape input and output. WordPress's sanitize_text_field() function preserves HTML-entity-encoded payloads, which the plugin then decodes server-side, allowing the malicious script to be stored and executed in users' browsers when they access the injected page.

An attacker with subscriber-level access can inject malicious scripts that execute in the context of other users' browsers when they view affected pages. This can lead to information disclosure or session hijacking limited to the privileges of the affected users. The vulnerability does not allow privilege escalation or denial of service but can compromise user data confidentiality and integrity within the affected plugin's context.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict subscriber-level user capabilities where possible and consider disabling or replacing the plugin if feasible. Avoid granting unnecessary privileges to low-level users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.