CVE-2026-103520
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The HivePress plugin for WordPress up to version 1.7.31 is vulnerable to stored XSS via the 'custom text attribute' parameter. Exploitation requires an administrator to configure a Text attribute with a display format placing %value% inside an HTML attribute.
Risk Assessment
Authenticated attackers with subscriber-level access can inject malicious scripts that execute for other users, potentially leading to data theft or session hijacking.
Recommendation
Update the HivePress plugin to the latest version. Modify attribute configuration to avoid placing %value% in HTML attributes.
Other vulnerabilities in HivePress
See all- CVE-2026-110885Medium
The HivePress plugin for WordPress (up to version 1.7.32) has a Code Injection vulnerability due to improper control of code generation. An attacker can inject and execute arbitrary code in the application context.
- CVE-2026-110887Critical
The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.
Original NVD description (English source)
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS