CVE-2026-109193: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hivepress HivePress – Business Directory, Listings & Classified Ads Plugin

CVE-2026-109193 is a stored cross-site scripting vulnerability (CWE-79) in the HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress. The vulnerability exists in the handling of the '<custom user attribute slug>' parameter, which lacks proper input sanitization and output escaping. This allows unauthenticated attackers to inject malicious scripts into pages, which execute in the context of users visiting those pages. Exploitation depends on an administrator configuring a custom user attribute with a display_format template embedding the %value% token within href, src, or style HTML attributes, which is a documented plugin feature. The vulnerability affects all versions up to and including 1.7.32.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, leading to potential compromise of user sessions, theft of sensitive information, or execution of arbitrary scripts in the context of affected users. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), indicating significant risk due to network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no availability impact.

No official patch or fix is currently documented. Administrators should review and avoid configuring custom user attributes with display_format templates that place user-controlled values inside href, src, or style attributes. Monitor vendor advisories for updates or patches addressing this vulnerability. Implementing strict input validation and output escaping for custom user attributes is recommended once a fix is available.