HivePress vulnerabilities

The HivePress plugin for WordPress (up to version 1.7.32) has a Code Injection vulnerability due to improper control of code generation. An attacker can inject and execute arbitrary code in the application context.

The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.

The HivePress plugin for WordPress up to version 1.7.31 is vulnerable to stored XSS via the 'custom text attribute' parameter. Exploitation requires an administrator to configure a Text attribute with a display format placing %value% inside an HTML attribute.