Stored Cross-Site Scripting Vulnerability in HivePress Business Directory Plugin

CVE-2026-109388

What is CVE-2026-109388?

The HivePress plugin for WordPress, specifically the Business Directory, Listings & Classified Ads Plugin, exhibits a stored cross-site scripting vulnerability through the 'message' parameter. This issue arises from inadequate input sanitization and output escaping across all versions up to and including 1.7.32. Authenticated attackers with subscriber-level access or higher can leverage this vulnerability to insert arbitrary web scripts that execute upon user access. Successful exploitation necessitates that the site administrator has activated the user listing submission feature, resulting in scripts running in the victim's browser when they log in via the compromised form on the attacker's listing page.

References