CVE-2026-109388: HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim's browser at the moment of successful login via the embedded form on the attacker's listing page.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using HivePress versions through 1.7.32 are exposed only if the administrator has enabled user listing submission. The vulnerable login form must also be embedded on an attacker-controlled listing page for the payload to execute.
What level of access does an attacker need?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No victim interaction beyond successfully logging in through the embedded form on the malicious listing page is required for script execution.
When does the injected script run?
The stored script executes in the browser of a user who accesses the attacker’s listing page and successfully logs in using the embedded HivePress user login form. It does not execute merely when the attacker submits the malicious message value.
How can administrators assess whether they are affected?
Check whether the site runs HivePress 1.7.32 or an earlier version, whether user listing submission is enabled, and whether user-created listings can contain an embedded hivepress_user_login_form shortcode with a message attribute.