CVE-2026-107657

Name of the Vulnerable Software and Affected Versions HivePress versions prior to 1.7.32

Description The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via a custom user attribute field name parameter. These scripts execute when a user accesses the affected page. This occurs when an administrator configures a text-type custom user attribute where the %value% is placed inside an HTML attribute context and front-end user profiles are enabled.

Recommendations Update to a version newer than 1.7.31. As a temporary mitigation, avoid configuring text-type custom user attributes that place %value% inside HTML attribute contexts or disable front-end user profiles.