CVE-2026-103520: HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

Q: What conditions are required for exploitation?

An attacker must have an authenticated WordPress account with at least Subscriber-level access and be able to submit a value for the affected custom text listing attribute. Exploitation additionally requires an administrator-configured Text attribute whose display format inserts the %value% token inside an HTML attribute, such as title="%value%".

Q: Who is exposed to the injected script?

The script executes whenever a user accesses a page containing the attacker-injected value. This can affect any user who views the affected listing page, not only the authenticated attacker.

Q: How can administrators identify whether their configuration is vulnerable?

Review configured HivePress Text attributes and inspect their display formats. Attributes that place %value% within an HTML attribute are the affected configuration pattern.

Q: What can be changed if patching is not immediately possible?

Avoid using %value% inside HTML attributes in Text attribute display formats. Removing or changing those formats prevents the documented prerequisite for exploitation.

Published Oct 10, 2026

Updated

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern.

Affected Software

1 affected component

HivePress HivePress – Business Directory, Listings & Classified Ads Plugin<=1.7.31

Event History

Oct 10, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must have an authenticated WordPress account with at least Subscriber-level access and be able to submit a value for the affected custom text listing attribute. Exploitation additionally requires an administrator-configured Text attribute whose display format inserts the %value% token inside an HTML attribute, such as title="%value%".

Who is exposed to the injected script?

The script executes whenever a user accesses a page containing the attacker-injected value. This can affect any user who views the affected listing page, not only the authenticated attacker.

How can administrators identify whether their configuration is vulnerable?

Review configured HivePress Text attributes and inspect their display formats. Attributes that place %value% within an HTML attribute are the affected configuration pattern.

What can be changed if patching is not immediately possible?

Avoid using %value% inside HTML attributes in Text attribute display formats. Removing or changing those formats prevents the documented prerequisite for exploitation.

CVE-2026-103520: HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Who is exposed to the injected script?

How can administrators identify whether their configuration is vulnerable?

What can be changed if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Who is exposed to the injected script?

How can administrators identify whether their configuration is vulnerable?

What can be changed if patching is not immediately possible?