HivePress – Business Directory, Listings & Classified Ads Plugin (<= 1.7.32) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hivepress--business-directory-listings--classified-ads-plugin--1.7.32/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 08:25:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in HivePress WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-hivepress-xss/Fri, 16 Oct 2026 08:25:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-hivepress-xss/An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in HivePress plugin versions 1.7.32 and earlier allows attackers to inject malicious scripts into attribute fields.The HivePress - Business Directory, Listings & Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.7.32. The vulnerability stems from insufficient input sanitization and output escaping when processing custom user attribute slugs (e.g., hp_custom_link). An unauthenticated attacker can exploit this by injecting arbitrary web scripts into user attribute values. Successful exploitation depends on an administrator having configured a custom user attribute where the display_format template includes the %value% token within an href, src, or style attribute context. When an unsuspecting user or administrator views a page where this attribute is rendered, the injected script executes within the victim's session.

Impact

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of a user's browser session. If an administrator views an injected page, the attacker could potentially perform unauthorized administrative actions, capture session cookies, or redirect users to malicious domains. This affects any WordPress installation utilizing the HivePress plugin for business directories or classified ads with custom user attributes enabled.

Recommendation

  1. Upgrade the HivePress plugin to the latest version immediately to remediate the sanitization flaw (CVE-2026-109193).
  2. Audit current HivePress custom user attribute configurations to identify if the %value% token is used within href, src, or style attributes.
  3. Implement a strict Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the sources from which scripts can be loaded and executed.
  4. Use web application firewalls (WAF) to inspect incoming traffic for suspicious script tags or JavaScript event handlers injected into POST requests targeting attribute update endpoints.
]]>highadvisorywordpressxssweb-application