Stored Cross-Site Scripting in HivePress Business Directory Plugin for WordPress
CVE-2026-109193

7.2HIGH

Key Information:

Vendor

WordPress
Status
Hivepress – Business Directory, Listings & Classified Ads Plugin
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109193?

The HivePress plugin for WordPress contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into pages viewed by users. This flaw arises from insufficient sanitization and escaping of user input. Unsanitized parameters in custom user attributes enable unauthenticated attackers to execute arbitrary scripts when the altered page is accessed. Exploitation of this vulnerability necessitates specific configurations where custom attributes are improperly set up, especially if the %value% token is integrated within HTML attributes such as href, src, or style.

Affected Version(s)

HivePress – Business Directory, Listings & Classified Ads Plugin 0 <= 1.7.32

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/hivepress/tags...
https://plugins.trac.wordpress.org/browser/hivepress/tags...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

braintx
.