High severity · published Oct 16, 2026
CVE-2026-109193
HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
HivePress – Business Directory, Listings & Classified Ads Plugin · hivepress
through 1.7.32 · source: vendor
Affected product
HB
HivePress – Business Directory, Listings & Classified Ads Plugin
hivepress
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109193
github.com
https://github.com/hivepress/hivepress/pull/375/changes/60df383473ff4b7a85f24b06895ec236edf20c9d
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-attribute.php#L1199
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-attribute.php#L1293
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/controllers/class-user.php#L292
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-field.php#L572
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-text.php#L197
More from HivePress – Business Directory, Listings & Classified Ads Plugin
7.2
CVE-2026-107657
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
6.4
CVE-2026-109388
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
6.4
CVE-2026-103520
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format