CVE-2026-107657: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hivepress HivePress – Business Directory, Listings & Classified Ads Plugin

CVE-2026-107657 is a stored cross-site scripting vulnerability (CWE-79) in the HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress. It occurs due to insufficient sanitization and escaping of the '<custom user attribute field name>' parameter in versions up to 1.7.31. An unauthenticated attacker can inject arbitrary web scripts that execute when users access the affected pages. Successful exploitation depends on the plugin being configured with a text-type custom user attribute whose display format places the value inside an HTML attribute context (e.g., <a href="%value%">) and front-end user profiles being enabled, which are standard documented configurations of the plugin.

An attacker can inject persistent malicious scripts that execute in the context of users visiting the affected pages, potentially leading to information disclosure and limited integrity impact. The vulnerability does not affect availability. The CVSS 3.1 base score is 7.2 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. This means the vulnerability can be exploited remotely without authentication or user interaction, affecting components beyond the vulnerable plugin.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid configuring text-type custom user attributes that place values inside HTML attribute contexts and consider disabling front-end user profiles to reduce exposure. Monitoring vendor channels for updates and applying official patches once released is recommended.