Live › vulnerability › CVE-2026-109193
Go to dashboardThe HivePress business directory plugin for WordPress does not sanitize or escape a custom user attribute slug parameter, up to and including version 1.7.32. An unauthenticated attacker can store scripts that run in the browser of any visitor who opens an affected page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running HivePress up to and including 1.7.32 that have configured a custom user attribute with a display_format placing %value% inside an href, src or style attribute are exposed. Sites without the plugin, on a newer version, or without such an attribute configured are not affected by this description.
No product ranges from the sources yet.
wp plugin get hivepress --field=version1.7.32; the sources do not name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
This page as .md · .json · in your agent: get_signal("CVE-2026-109193")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.