{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/hivepress--business-directory-listings--classified-ads-plugin--1.7.32/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hivepress:hivepress:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109193"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HivePress – Business Directory, Listings \u0026 Classified Ads Plugin (\u003c= 1.7.32)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application"],"_cs_type":"advisory","_cs_vendors":["HivePress"],"content_html":"\u003cp\u003eThe HivePress - Business Directory, Listings \u0026amp; Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.7.32. The vulnerability stems from insufficient input sanitization and output escaping when processing custom user attribute slugs (e.g., hp_custom_link). An unauthenticated attacker can exploit this by injecting arbitrary web scripts into user attribute values. Successful exploitation depends on an administrator having configured a custom user attribute where the display_format template includes the %value% token within an href, src, or style attribute context. When an unsuspecting user or administrator views a page where this attribute is rendered, the injected script executes within the victim's session.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of a user's browser session. If an administrator views an injected page, the attacker could potentially perform unauthorized administrative actions, capture session cookies, or redirect users to malicious domains. This affects any WordPress installation utilizing the HivePress plugin for business directories or classified ads with custom user attributes enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the HivePress plugin to the latest version immediately to remediate the sanitization flaw (CVE-2026-109193).\u003c/li\u003e\n\u003cli\u003eAudit current HivePress custom user attribute configurations to identify if the %value% token is used within href, src, or style attributes.\u003c/li\u003e\n\u003cli\u003eImplement a strict Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the sources from which scripts can be loaded and executed.\u003c/li\u003e\n\u003cli\u003eUse web application firewalls (WAF) to inspect incoming traffic for suspicious script tags or JavaScript event handlers injected into POST requests targeting attribute update endpoints.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T08:25:23Z","date_published":"2026-10-16T08:25:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hivepress-xss/","summary":"An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in HivePress plugin versions 1.7.32 and earlier allows attackers to inject malicious scripts into attribute fields.","title":"Stored Cross-Site Scripting in HivePress WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-hivepress-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - HivePress – Business Directory, Listings \u0026 Classified Ads Plugin (\u003c= 1.7.32)","version":"https://jsonfeed.org/version/1.1"}