CVE-2026-107657
Received Received - Intake

Stored XSS in HivePress WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern &lt;a href="%value%"&gt;Custom link&lt;/a&gt;), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-107657
EUVD
EUVD-2026-96301

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hivepress HivePress – Business Directory, Listings & Classified Ads Plugin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The HivePress WordPress plugin up to version 1.7.31 has a stored Cross-Site Scripting (XSS) vulnerability. Attackers can inject malicious scripts via custom user attribute fields due to insufficient input sanitization and output escaping. These scripts execute when users access infected pages.

Detection Guidance

Check for suspicious user attribute fields in WordPress admin panels configured with text-type custom attributes. Inspect front-end user profiles for unexpected script injections or malformed HTML links. Review plugin version in WordPress dashboard to confirm if HivePress is below 1.7.32.

Impact Analysis

Unauthenticated attackers can inject arbitrary web scripts into pages. If an administrator has set up a text-type custom user attribute with a vulnerable display format and front-end profiles are enabled, users accessing those profiles may have their sessions compromised or malicious actions performed on their behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive user information or allowing script execution in contexts where it shouldn't occur.

Mitigation Strategies

Update the HivePress plugin to version 1.7.32 or later immediately. Disable custom user attribute fields using HTML attribute contexts until updated. Monitor user profiles for unauthorized script injections or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart