Skip to content
PluginCanary

Better Messages

Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots
by wordplus · 10,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 211 releases in 24 months, no unpatched vulnerabilities.

85/ 100 Canary Score

Based on all 5 areas

Sub-scores for Better Messages
Ownership100
Maintenance100
Security50
Support100
Reputation85

How the score works

Quick answers

Is Better Messages still maintained?
Yes. Last release 2 Nov 2026, 211 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns Better Messages, and has it changed hands?
No change recorded. Main committer wordplus since Jan 2017. 4 Nov 2026 · SVN log
Was Better Messages removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Better Messages safe?
26 known vulnerabilities, all fixed (latest in 3.1.4). Not on the exploited list. 22 Oct 2026 · Wordfence Intelligence
Is the latest Better Messages update safe to install?
No ownership change before 3.2.1. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wordplus5 Jan 2017 to 2 Nov 2026, 1300 commits

1 committer recorded. No ownership change since 2017.

Maintenance

Last release
2 days ago
Releases, 24 months
211
Tested up to
7.2 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for Better Messages
Q1 202411
Q2 20246
Q3 20241
Q4 20242
Q1 202562
Q2 20254
Q3 20257
Q4 20252
Q1 202613
Q2 20263
Q3 2026108
Q4 202610

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (4 reviews). Lifetime: 4.8.

Average rating per quarter for Better Messages
Q4 20235.0
Q1 20245.0
Q2 20245.0
Q3 20243.0
Q1 20255.0
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q2 20265.0
Q3 20265.0

Average rating stayed at 5.0 between Q4 2023 and Q3 2026.

Rating distribution
5 star133
4 star2
3 star0
2 star1
1 star6
Latest low reviews

Security record

15 vulnerabilities in 24 months (26 on record), all patched (latest fixed in 3.1.4).

Show 26 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
22 Oct 2026Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.1.33.1.4Patched before disclosure
24 Sep 2026Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name6.4<= 3.0.43.0.5Patched before disclosure
24 Sep 2026Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter6.5<= 3.0.43.0.5Patched before disclosure
18 Sep 2026Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register5.3<= 2.15.333.0.0Patched before disclosure
18 Sep 2026Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint6.5<= 2.15.333.0.0Patched before disclosure
15 Sep 2026Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter6.1<= 2.15.222.15.231
2 Sep 2026Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.15.272.15.2814
18 Aug 2026Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.15.222.15.2329
27 Jul 2026Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter7.2<= 2.15.192.15.2051
27 May 2026Better Messages - Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.14.16 - Unauthenticated Insecure Direct Object Reference5.3<= 2.14.162.15.0112
30 Apr 2026Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter6.1<= 2.6.72.7.0139
16 Dec 2025Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting6.1<= 2.10.22.10.3274
28 Feb 2025Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory7.5<= 2.6.92.7.0565
28 Feb 2025Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links4.8<= 2.7.42.7.5565
31 Jan 2025Better Messages - Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 2.6.92.7.0593
22 Apr 2024BP Better Messages <= 2.4.32 - Missing Authorization5.3<= 2.4.322.4.33332
29 Nov 2023BP Better Messages <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode6.4<= 2.4.02.4.1477
18 Jul 2023Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get6.11.9.10.72 to 2.1.172.1.18611
9 Nov 2022Better Messages <= 1.9.10.68 - Authorization Bypass to Blocking Control Bypass5.4<= 1.9.10.681.9.10.69n/a
21 Oct 2022Better Messages <= 1.9.10.68 - Server-Side Request Forgery7.4<= 1.9.10.681.9.10.69n/a
22 Aug 2022Better Messages <= 1.9.10.57 - Resource Exhaustion7.7<= 1.9.10.571.9.10.58n/a
4 Mar 2022Freemius SDK <= 2.4.2 - Missing Authorization Checks6.3< 1.9.9.1701.9.9.170n/a
18 Jan 2022Better Messages <= 1.9.9.148 - Cross-Site Request Forgery8.8<= 1.9.9.1481.9.9.149n/a
18 Jan 2022Better Messages <= 1.9.9.148 - Cross-Site Request Forgery8.8<= 1.9.9.1481.9.9.149n/a
4 Oct 2021BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery8.8< 1.9.9.411.9.9.41n/a

Changelog mentions of security fixes: 3.0.12 (security, escaping); 3.0.13 (security); 3.0.14 (security); 3.1.0 (security); 3.1.4 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 11 support threads resolved in the last 2 months.

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Better Messages
4 May 20264,460
11 May 202616,243
18 May 202614,415
25 May 20268,867
1 Jun 20263,918
8 Jun 20265,542
15 Jun 20261,517
22 Jun 20265,046
29 Jun 20269,369
6 Jul 20266,265
13 Jul 20266,305
20 Jul 20265,997
27 Jul 202614,113
3 Aug 202610,572
10 Aug 202613,890
17 Aug 20267,312
24 Aug 202610,084
31 Aug 202610,452
7 Sep 20266,150
14 Sep 20267,946
21 Sep 202618,336
28 Sep 20269,417
5 Oct 202610,517
12 Oct 20269,354
19 Oct 202615,914
26 Oct 20265,834
2 Nov 2026481

Weekly downloads over the last 4 weeks are 11% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

bbPressScore 89 · 100,000+BuddyPressScore 86 · 90,000+wpForo ForumScore 86 · 20,000+Asgaros ForumScore 86 · 10,000+

Facts

Version3.2.1
Authorwordplus
Added3 Jan 2017
Last updated2 Nov 2026
Active installs10,000+
Requires WordPress5.9.0
Tested up to7.2
Requires PHP7.4
CategoryCommunity & Social > Social Networking Features
Tagschat room, buddypress, group chat, video chat, private message

Other plugins by this author: WordPlus Live Stream - Low Latency Streaming

Questions

Is Better Messages still maintained?

Yes. Last release 2 Nov 2026, 211 releases in the last 24 months.

Who owns Better Messages, and has it changed hands?

No change recorded. Main committer wordplus since Jan 2017.

Was Better Messages removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Better Messages safe?

26 known vulnerabilities, all fixed (latest in 3.1.4). Not on the exploited list.

Is the latest Better Messages update safe to install?

No ownership change before 3.2.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue