CVE-2026-103520

Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.32

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the custom text attribute (user-defined field name) parameter. The issue is exploitable when an administrator configures a Text attribute with a display format that places the %value% token inside an HTML attribute. This allows the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update HivePress – Business Directory, Listings & Classified Ads Plugin to version 1.7.32 or later.