HivePress HivePress – Business Directory, Listings & Classified Ads Plugin

• CVE-2026-109193 High 7.2 HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value 0.4%
• CVE-2026-109388 Medium 6.4 HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode 0.2%
• CVE-2026-107657 High 7.2 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form 0.2%
• CVE-2026-103520 Medium 6.4 HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format 0.2%