HivePress
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| HivePress – Business Directory, Listings & Classified Ads Plugin | 4 | – | Oct 16, 2026 |
| HivePress Claim Listings | 3 | – | Oct 29, 2026 |
| HivePress | 2 | – | Oct 19, 2026 |
| HivePress Authentication | 1 | – | Sep 6, 2026 |
Exploited and recent CVEs
- CVE-2026-42707 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability 0.2%
- CVE-2026-110887 WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability 0.4%
- CVE-2026-110885 WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability 0.3%
- CVE-2026-109193 HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value 0.4%
- CVE-2026-109388 HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode 0.2%
- CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form 0.2%
- CVE-2026-103520 HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format 0.2%
- CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator 0.6%
- CVE-2025-60123 WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability 0.2%
- CVE-2025-60122 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability 0.2%