CVE-2026-103520: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hivepress HivePress – Business Directory, Listings & Classified Ads Plugin

CVE-2026-103520 is a stored cross-site scripting vulnerability (CWE-79) in the HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress. The flaw exists due to improper neutralization of input in the 'custom text attribute' parameter, which is insufficiently sanitized and escaped. This allows authenticated attackers with subscriber-level privileges or above to inject malicious scripts into pages, which execute in the context of users viewing those pages. Exploitation requires that an administrator has configured a Text attribute whose display format embeds the user input inside an HTML attribute (e.g., title="%value%"), a known HivePress pattern.

Successful exploitation can lead to the execution of arbitrary scripts in the browsers of users who view the injected pages, potentially resulting in information disclosure or session hijacking. The vulnerability requires authenticated access at subscriber level or higher and specific administrator configuration to be exploitable. There is no indication of impact on availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. In the meantime, administrators should avoid configuring Text attributes that place user input inside HTML attributes (e.g., title="%value%") to reduce exposure. Additionally, restricting subscriber-level users from adding or modifying custom text attributes can mitigate exploitation risk.