CVE-2026-109193

Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.33

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the <custom user attribute slug> (e.g., hp custom link) parameter. The issue is exploitable when an administrator configures a custom user attribute with a display format template that places the %value% token within an href, src, or style attribute context. When a user accesses the affected page, the injected scripts execute in their browser.

Recommendations Update HivePress – Business Directory, Listings & Classified Ads Plugin to version 1.7.33 or later.