Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

80 Quality Score

Active Installs

18/30

With 10,000 active installs it has a real user base, though it remains a niche BuddyPress add-on rather than a mainstream plugin.

Update Freshness

25/25

Last updated 9 July 2026 and fully resolved support threads show the developer is actively shipping fixes and improvements.

User Rating

14/15

A 96 out of 100 from 137 reviewers is a strong endorsement, indicating most users are happy with the result after installation.

Support Health

8/15

All 18 support threads have been resolved, which is a 100% resolution rate and a very positive signal for paying users.

WP Compatibility

15/15

Tested with WordPress 7.0.1, requiring WordPress 5.9.0 and PHP 7.4, which covers the vast majority of current hosting environments.

Scores higher than 78% of indexed plugins

About

Real-time messaging and chat rooms for WordPress ecosystem: private conversations, public and private chat rooms, video & audio calls, and more.

Active Installs 10k+

Rating ★★★★½ 4.8/5

Last Updated 2026-09-26 4:49pm GMT

Requires WordPress 5.9.0+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

25 known vulnerabilities, all patched

9 High 16 Medium

Most recent: September 24, 2026

View details ▸

Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name Medium

September 24, 2026 Patched in ["3.0.5"] CVE-2026-94376

Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter Medium

September 24, 2026 Patched in ["3.0.5"] CVE-2026-93899

Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register Medium

September 18, 2026 Patched in ["3.0.0"] CVE-2026-89093

Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint Medium

September 18, 2026 Patched in ["3.0.0"] CVE-2026-89334

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter Medium

September 15, 2026 Patched in ["2.15.23"] CVE-2026-18555

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting High

September 2, 2026 Patched in ["2.15.28"] CVE-2026-84812

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting High

August 18, 2026 Patched in ["2.15.23"] CVE-2026-32547

Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter High

July 27, 2026 Patched in ["2.15.20"] CVE-2026-16585

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.14.16 - Unauthenticated Insecure Direct Object Reference Medium

May 27, 2026 Patched in ["2.15.0"] CVE-2026-42736

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Medium

April 30, 2026 Patched in ["2.7.0"] CVE-2024-13362

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting Medium

December 16, 2025 Patched in ["2.10.3"] CVE-2025-14154

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory High

February 28, 2025 Patched in ["2.7.0"] CVE-2024-13611

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links Medium

February 28, 2025 Patched in ["2.7.5"] CVE-2024-13697

Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

January 31, 2025 Patched in ["2.7.0"] CVE-2024-13612

BP Better Messages <= 2.4.32 - Missing Authorization Medium

April 22, 2024 Patched in ["2.4.33"] CVE-2024-32802

BP Better Messages <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Medium

November 29, 2023 Patched in ["2.4.1"] CVE-2023-49168

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["2.1.18"] CVE-2023-33999

Better Messages <= 1.9.10.68 - Authorization Bypass to Blocking Control Bypass Medium

November 9, 2022 Patched in ["1.9.10.69"] CVE-2022-40216

Better Messages <= 1.9.10.68 - Server-Side Request Forgery High

October 21, 2022 Patched in ["1.9.10.69"] CVE-2022-41609

Better Messages <= 1.9.10.57 - Resource Exhaustion High

August 22, 2022 Patched in ["1.9.10.58"] CVE-2022-33142

Freemius SDK <= 2.4.2 - Missing Authorization Checks Medium

March 4, 2022 Patched in ["1.9.9.170"] CVE-2022-4974

Better Messages <= 1.9.9.148 - Cross-Site Request Forgery High

January 18, 2022 Patched in ["1.9.9.149"] CVE-2022-36389

Better Messages <= 1.9.9.148 - Cross-Site Request Forgery High

January 18, 2022 Patched in ["1.9.9.149"] CVE-2022-29454

BP Better Messages <= 1.9.9.37 - Reflected Cross-Site Scripting Medium

October 4, 2021 Patched in ["1.9.9.41"] CVE-2021-24808

BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery High

October 4, 2021 Patched in ["1.9.9.41"] CVE-2021-24809

What It Does

Better Messages turns a WordPress site into a real-time communication hub with one-to-one private chats, public and private group rooms, plus video and audio calling. It integrates with BuddyPress so site members can message each other from their profiles without leaving WordPress. The included AI chat bot support lets admins automate responses or build interactive chat experiences.

Who It's For

This plugin is built for community, membership, or BuddyPress-driven sites where peer-to-peer conversation is core to the experience, such as online courses, fan communities, social networks, and niche member groups. It suits site owners who want a self-hosted alternative to third-party chat platforms like Slack or Discord. Smaller publishers without an existing member base will get less out of it.

Who Should Skip It

If you run a standard blog, brochure site, or small WooCommerce store without a community component, you do not need a full chat suite. Sites already using a dedicated forum plugin like bbPress or an external chat tool will find the feature overlap wasteful.

The Bottom Line

Better Messages scores 87.31 out of 100 and delivers an impressive feature set for BuddyPress communities, with strong ratings, active maintenance, and perfect support resolution. Its 10,000 installs are modest in absolute terms, but the satisfaction metrics make it a confident pick for community sites that need real-time chat. Skip it if you do not already have a member-driven site where conversation is central.

Related Plugins

BP Profile Search 79/100

Pick this instead if your priority is letting members search and filter BuddyPress profiles rather than chatting with them.

Youzify 79/100

Choose Youzify when you want to overhaul the entire BuddyPress profile, layout, and community design along with adding messaging features.

BuddyPress Xprofile Custom Field Types 78/100

Go with this if you need richer custom profile fields rather than a real-time chat layer.

WPML Multilingual for BuddyPress and BuddyBoss 78/100

Pick this when running a multilingual BuddyPress site is the main goal and chat is secondary.

Spam Destroyer 78/100

Choose Spam Destroyer if spam control is your pressing issue and a full messaging platform is overkill.