CVE-2026-109388: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hivepress HivePress – Business Directory, Listings & Classified Ads Plugin

CVE-2026-109388 is a stored cross-site scripting vulnerability (CWE-79) in the HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping of the 'message' parameter, allowing authenticated attackers with subscriber-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of other users when they access the compromised page, notably triggered upon successful login via an embedded form on the attacker's listing page. The vulnerability affects all versions up to and including 1.7.32.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the browsers of users who visit the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires subscriber-level access and the site to have user listing submission enabled. There is no indication of active exploitation in the wild.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling user listing submissions or restricting subscriber-level user capabilities to mitigate risk.