Search
Find a vulnerability
Search criteria
18 vulnerabilities by hivepress
CVE-2026-110887 (GCVE-0-2026-110887)
Vulnerability from nvd – Published: 2026-10-19 09:09 – Updated: 2026-10-19 16:51 X_Open Source
VLAI
EPSS
VEX
Title
WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:50 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
Date Public
2026-10-17 08:45
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110887",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:50:50.898555Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:51:04.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress",
"product": "HivePress",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.8.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AndrewN | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-17T08:45:57.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.\u003cp\u003eThis issue affects HivePress: from n/a through 1.7.32.\u003c/p\u003e"
}
],
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:09:19.849Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-remote-code-execution-rce-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress HivePress plugin \u003c= 1.7.32 - Remote Code Execution (RCE) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110887",
"datePublished": "2026-10-19T09:09:19.849Z",
"dateReserved": "2026-10-15T00:19:27.826Z",
"dateUpdated": "2026-10-19T16:51:04.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110885 (GCVE-0-2026-110885)
Vulnerability from nvd – Published: 2026-10-18 11:00 – Updated: 2026-10-19 19:03 X_Open Source
VLAI
EPSS
VEX
Title
WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:03 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
Date Public
2026-10-16 10:35
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110885",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T19:03:12.138723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:03:21.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress",
"product": "HivePress",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.8.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "changsheng | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-16T10:35:29.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Code Injection.\u003cp\u003eThis issue affects HivePress: from n/a through 1.7.32.\u003c/p\u003e"
}
],
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:00:22.694Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-content-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress HivePress plugin \u003c= 1.7.32 - Content Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110885",
"datePublished": "2026-10-18T11:00:22.694Z",
"dateReserved": "2026-10-15T00:19:27.826Z",
"dateUpdated": "2026-10-19T19:03:21.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109388 (GCVE-0-2026-109388)
Vulnerability from nvd – Published: 2026-10-16 06:41 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim's browser at the moment of successful login via the embedded form on the attacker's listing page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.32
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:34:00.710695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:02.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sebastian Albrecht (mySebbe)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027message\u0027 parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim\u0027s browser at the moment of successful login via the embedded form on the attacker\u0027s listing page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:41:04.192Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1937ae-d350-452c-b20e-d85bc88dbe48?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/assets/js/common.js#L1278"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/forms/class-form.php#L189"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/blocks/class-form.php#L89"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-editor.php#L417"
},
{
"url": "https://github.com/hivepress/hivepress/pull/374/changes/508b1766beb79949ab22dd4a163fafadb4c63e7d"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3747070%40hivepress%2Ftags%2F1.8.0\u0026old=3732142%40hivepress%2Ftags%2F1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T14:52:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T17:55:17.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027message\u0027 Attribute of the hivepress_user_login_form Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109388",
"datePublished": "2026-10-16T06:41:04.192Z",
"dateReserved": "2026-10-12T14:36:51.030Z",
"dateUpdated": "2026-10-16T14:39:02.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109193 (GCVE-0-2026-109193)
Vulnerability from nvd – Published: 2026-10-16 06:41 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.32
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:33:55.128477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:02.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "braintx"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003ccustom user attribute slug\u003e (e.g. hp_custom_link)\u0027 parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin\u0027s attribute display feature."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:41:06.532Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c3752b-0d2f-402d-bdbf-fb3fd76cf558?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-field.php#L572"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-attribute.php#L1199"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-text.php#L214"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/controllers/class-user.php#L292"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-attribute.php#L1293"
},
{
"url": "https://github.com/hivepress/hivepress/pull/375/changes/60df383473ff4b7a85f24b06895ec236edf20c9d"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3747070/hivepress/trunk/includes/fields/class-field.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T13:34:33.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T17:55:27.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109193",
"datePublished": "2026-10-16T06:41:06.532Z",
"dateReserved": "2026-10-12T13:19:13.435Z",
"dateUpdated": "2026-10-16T14:39:02.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107657 (GCVE-0-2026-107657)
Vulnerability from nvd – Published: 2026-10-10 08:26 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href="%value%">Custom link</a>), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:10 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.31
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:10:57.052125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Brunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003ccustom user attribute field name, e.g. profile_test\u003e\u0027 parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern \u0026lt;a href=\"%value%\"\u0026gt;Custom link\u0026lt;/a\u0026gt;), and for front-end user profiles to be enabled \u2014 both of which reflect the plugin\u0027s standard, documented configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:40.211Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/components/class-attribute.php#L1298"
},
{
"url": "https://github.com/hivepress/hivepress/releases/tag/1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T14:51:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:43:31.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-107657",
"datePublished": "2026-10-10T08:26:40.211Z",
"dateReserved": "2026-10-08T14:36:30.619Z",
"dateUpdated": "2026-10-11T12:13:43.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103520 (GCVE-0-2026-103520)
Vulnerability from nvd – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:36
VLAI
EPSS
VEX
Title
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.31
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103520",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:16:24.030194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:36:28.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027custom text attribute (user-defined field name)\u0027 parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title=\"%value%\"), which is a documented HivePress pattern."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:30:59.972Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/723322ab-2ad0-42e2-b518-0987d9203c49?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/blocks/class-attributes.php#L219"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/controllers/class-listing.php#L346"
},
{
"url": "https://github.com/hivepress/hivepress/releases/tag/1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-01T17:37:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:15:30.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103520",
"datePublished": "2026-10-10T05:30:59.972Z",
"dateReserved": "2026-09-30T19:01:59.662Z",
"dateUpdated": "2026-10-11T16:36:28.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18056 (GCVE-0-2026-18056)
Vulnerability from nvd – Published: 2026-09-06 02:26 – Updated: 2026-09-07 11:17
VLAI
EPSS
VEX
Title
HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
Summary
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-07 11:03 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress Authentication |
Affected:
0 , ≤ 1.1.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18056",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-07T11:03:04.808288Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T11:17:23.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress Authentication",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mutantgun"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function\u0027s Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation \u2014 specifically, no /debug_token verification and no comparison of the token\u0027s app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim\u0027s access token."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T02:26:51.649Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ba6392-e6f7-479a-8b9b-9cea4b140c71?source=cve"
},
{
"url": "https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/#confirm"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress-authentication/tags/1.1.4/includes/components/class-facebook-authentication.php#L59"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress-authentication/tags/1.1.4/includes/controllers/class-authentication.php#L84"
},
{
"url": "https://github.com/hivepress/hivepress-authentication/commit/f97d9109002905cf57597d15c535d1155dc64657"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3664231/hivepress-authentication"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T16:33:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-05T14:06:18.000Z",
"value": "Disclosed"
}
],
"title": "HivePress Authentication \u003c= 1.1.4 - Unauthenticated Authentication Bypass via \u0027access_token\u0027 Parameter to Facebook Authenticator"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18056",
"datePublished": "2026-09-06T02:26:51.649Z",
"dateReserved": "2026-07-28T13:00:05.931Z",
"dateUpdated": "2026-09-07T11:17:23.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-60123 (GCVE-0-2025-60123)
Vulnerability from nvd – Published: 2025-09-26 08:31 – Updated: 2026-04-28 16:13
VLAI
EPSS
VEX
Title
WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-26 13:11 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HivePress | HivePress Claim Listings |
Affected:
0 , ≤ 1.1.3
(custom)
|
Date Public
2026-04-01 16:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-60123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-26T13:11:00.868377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-26T13:11:09.869Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress-claim-listings",
"product": "HivePress Claim Listings",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.1.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.1.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bao - BlueRock | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:43:33.016Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.3.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.3."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:13:55.298Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broken-access-control-vulnerability-2?_s_id=cve"
}
],
"title": "WordPress HivePress Claim Listings plugin \u003c= 1.1.3 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-60123",
"datePublished": "2025-09-26T08:31:38.284Z",
"dateReserved": "2025-09-25T15:20:29.870Z",
"dateUpdated": "2026-04-28T16:13:55.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-60122 (GCVE-0-2025-60122)
Vulnerability from nvd – Published: 2025-09-26 08:31 – Updated: 2026-04-28 16:13
VLAI
EPSS
VEX
Title
WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-26 13:11 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HivePress | HivePress Claim Listings |
Affected:
0 , ≤ 1.1.4
(custom)
|
Date Public
2026-04-01 16:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-60122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-26T13:11:24.476348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-26T13:11:33.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress-claim-listings",
"product": "HivePress Claim Listings",
"vendor": "HivePress",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bao - BlueRock | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:43:32.305Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.4.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.4."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:13:55.330Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress HivePress Claim Listings plugin \u003c= 1.1.4 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-60122",
"datePublished": "2025-09-26T08:31:37.615Z",
"dateReserved": "2025-09-25T15:20:29.870Z",
"dateUpdated": "2026-04-28T16:13:55.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110887 (GCVE-0-2026-110887)
Vulnerability from cvelistv5 – Published: 2026-10-19 09:09 – Updated: 2026-10-19 16:51 X_Open Source
VLAI
EPSS
VEX
Title
WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 16:50 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
Date Public
2026-10-17 08:45
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110887",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T16:50:50.898555Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:51:04.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress",
"product": "HivePress",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.8.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AndrewN | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-17T08:45:57.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.\u003cp\u003eThis issue affects HivePress: from n/a through 1.7.32.\u003c/p\u003e"
}
],
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:09:19.849Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-remote-code-execution-rce-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress HivePress plugin \u003c= 1.7.32 - Remote Code Execution (RCE) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110887",
"datePublished": "2026-10-19T09:09:19.849Z",
"dateReserved": "2026-10-15T00:19:27.826Z",
"dateUpdated": "2026-10-19T16:51:04.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110885 (GCVE-0-2026-110885)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:00 – Updated: 2026-10-19 19:03 X_Open Source
VLAI
EPSS
VEX
Title
WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:03 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
Date Public
2026-10-16 10:35
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110885",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T19:03:12.138723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:03:21.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress",
"product": "HivePress",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.8.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "changsheng | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-16T10:35:29.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Code Injection.\u003cp\u003eThis issue affects HivePress: from n/a through 1.7.32.\u003c/p\u003e"
}
],
"value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:00:22.694Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-content-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"value": "Update the WordPress HivePress plugin to the latest available version (at least 1.8.0)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress HivePress plugin \u003c= 1.7.32 - Content Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110885",
"datePublished": "2026-10-18T11:00:22.694Z",
"dateReserved": "2026-10-15T00:19:27.826Z",
"dateUpdated": "2026-10-19T19:03:21.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109193 (GCVE-0-2026-109193)
Vulnerability from cvelistv5 – Published: 2026-10-16 06:41 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin's attribute display feature.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.32
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:33:55.128477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:02.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "braintx"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003ccustom user attribute slug\u003e (e.g. hp_custom_link)\u0027 parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has configured a custom user attribute with a display_format template placing the %value% token inside an href, src, or style attribute context, which is a documented and expected use of the plugin\u0027s attribute display feature."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:41:06.532Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c3752b-0d2f-402d-bdbf-fb3fd76cf558?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-field.php#L572"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-attribute.php#L1199"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/fields/class-text.php#L214"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/controllers/class-user.php#L292"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-attribute.php#L1293"
},
{
"url": "https://github.com/hivepress/hivepress/pull/375/changes/60df383473ff4b7a85f24b06895ec236edf20c9d"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3747070/hivepress/trunk/includes/fields/class-field.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T13:34:33.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T17:55:27.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109193",
"datePublished": "2026-10-16T06:41:06.532Z",
"dateReserved": "2026-10-12T13:19:13.435Z",
"dateUpdated": "2026-10-16T14:39:02.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109388 (GCVE-0-2026-109388)
Vulnerability from cvelistv5 – Published: 2026-10-16 06:41 – Updated: 2026-10-16 14:39
VLAI
EPSS
VEX
Title
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim's browser at the moment of successful login via the embedded form on the attacker's listing page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.32
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:34:00.710695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:39:02.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sebastian Albrecht (mySebbe)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027message\u0027 parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim\u0027s browser at the moment of successful login via the embedded form on the attacker\u0027s listing page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:41:04.192Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1937ae-d350-452c-b20e-d85bc88dbe48?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/assets/js/common.js#L1278"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/forms/class-form.php#L189"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/blocks/class-form.php#L89"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.32/includes/components/class-editor.php#L417"
},
{
"url": "https://github.com/hivepress/hivepress/pull/374/changes/508b1766beb79949ab22dd4a163fafadb4c63e7d"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3747070%40hivepress%2Ftags%2F1.8.0\u0026old=3732142%40hivepress%2Ftags%2F1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T14:52:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T17:55:17.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027message\u0027 Attribute of the hivepress_user_login_form Shortcode"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109388",
"datePublished": "2026-10-16T06:41:04.192Z",
"dateReserved": "2026-10-12T14:36:51.030Z",
"dateUpdated": "2026-10-16T14:39:02.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107657 (GCVE-0-2026-107657)
Vulnerability from cvelistv5 – Published: 2026-10-10 08:26 – Updated: 2026-10-11 12:13
VLAI
EPSS
VEX
Title
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a href="%value%">Custom link</a>), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:10 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.31
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:10:57.052125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:43.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Brunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027\u003ccustom user attribute field name, e.g. profile_test\u003e\u0027 parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern \u0026lt;a href=\"%value%\"\u0026gt;Custom link\u0026lt;/a\u0026gt;), and for front-end user profiles to be enabled \u2014 both of which reflect the plugin\u0027s standard, documented configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T08:26:40.211Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/components/class-attribute.php#L1298"
},
{
"url": "https://github.com/hivepress/hivepress/releases/tag/1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-08T14:51:42.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T19:43:31.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-107657",
"datePublished": "2026-10-10T08:26:40.211Z",
"dateReserved": "2026-10-08T14:36:30.619Z",
"dateUpdated": "2026-10-11T12:13:43.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103520 (GCVE-0-2026-103520)
Vulnerability from cvelistv5 – Published: 2026-10-10 05:30 – Updated: 2026-10-11 16:36
VLAI
EPSS
VEX
Title
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
Summary
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin |
Affected:
0 , ≤ 1.7.31
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103520",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:16:24.030194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T16:36:28.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.7.31",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress \u2013 Business Directory, Listings \u0026 Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027custom text attribute (user-defined field name)\u0027 parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title=\"%value%\"), which is a documented HivePress pattern."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:30:59.972Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/723322ab-2ad0-42e2-b518-0987d9203c49?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/blocks/class-attributes.php#L219"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/controllers/class-listing.php#L346"
},
{
"url": "https://github.com/hivepress/hivepress/releases/tag/1.7.32"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-01T17:37:25.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T17:15:30.000Z",
"value": "Disclosed"
}
],
"title": "HivePress \u003c= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-103520",
"datePublished": "2026-10-10T05:30:59.972Z",
"dateReserved": "2026-09-30T19:01:59.662Z",
"dateUpdated": "2026-10-11T16:36:28.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18056 (GCVE-0-2026-18056)
Vulnerability from cvelistv5 – Published: 2026-09-06 02:26 – Updated: 2026-09-07 11:17
VLAI
EPSS
VEX
Title
HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
Summary
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-07 11:03 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hivepress | HivePress Authentication |
Affected:
0 , ≤ 1.1.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18056",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-07T11:03:04.808288Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T11:17:23.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HivePress Authentication",
"vendor": "hivepress",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mutantgun"
}
],
"descriptions": [
{
"lang": "en",
"value": "The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function\u0027s Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation \u2014 specifically, no /debug_token verification and no comparison of the token\u0027s app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim\u0027s access token."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T02:26:51.649Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ba6392-e6f7-479a-8b9b-9cea4b140c71?source=cve"
},
{
"url": "https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/#confirm"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress-authentication/tags/1.1.4/includes/components/class-facebook-authentication.php#L59"
},
{
"url": "https://plugins.trac.wordpress.org/browser/hivepress-authentication/tags/1.1.4/includes/controllers/class-authentication.php#L84"
},
{
"url": "https://github.com/hivepress/hivepress-authentication/commit/f97d9109002905cf57597d15c535d1155dc64657"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3664231/hivepress-authentication"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T16:33:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-05T14:06:18.000Z",
"value": "Disclosed"
}
],
"title": "HivePress Authentication \u003c= 1.1.4 - Unauthenticated Authentication Bypass via \u0027access_token\u0027 Parameter to Facebook Authenticator"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18056",
"datePublished": "2026-09-06T02:26:51.649Z",
"dateReserved": "2026-07-28T13:00:05.931Z",
"dateUpdated": "2026-09-07T11:17:23.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-60123 (GCVE-0-2025-60123)
Vulnerability from cvelistv5 – Published: 2025-09-26 08:31 – Updated: 2026-04-28 16:13
VLAI
EPSS
VEX
Title
WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-26 13:11 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HivePress | HivePress Claim Listings |
Affected:
0 , ≤ 1.1.3
(custom)
|
Date Public
2026-04-01 16:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-60123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-26T13:11:00.868377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-26T13:11:09.869Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress-claim-listings",
"product": "HivePress Claim Listings",
"vendor": "HivePress",
"versions": [
{
"changes": [
{
"at": "1.1.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.1.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bao - BlueRock | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:43:33.016Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.3.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.3."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:13:55.298Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broken-access-control-vulnerability-2?_s_id=cve"
}
],
"title": "WordPress HivePress Claim Listings plugin \u003c= 1.1.3 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-60123",
"datePublished": "2025-09-26T08:31:38.284Z",
"dateReserved": "2025-09-25T15:20:29.870Z",
"dateUpdated": "2026-04-28T16:13:55.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-60122 (GCVE-0-2025-60122)
Vulnerability from cvelistv5 – Published: 2025-09-26 08:31 – Updated: 2026-04-28 16:13
VLAI
EPSS
VEX
Title
WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-26 13:11 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HivePress | HivePress Claim Listings |
Affected:
0 , ≤ 1.1.4
(custom)
|
Date Public
2026-04-01 16:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-60122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-26T13:11:24.476348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-26T13:11:33.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "hivepress-claim-listings",
"product": "HivePress Claim Listings",
"vendor": "HivePress",
"versions": [
{
"lessThanOrEqual": "1.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bao - BlueRock | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:43:32.305Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.4.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through \u003c= 1.1.4."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:13:55.330Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress HivePress Claim Listings plugin \u003c= 1.1.4 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-60122",
"datePublished": "2025-09-26T08:31:37.615Z",
"dateReserved": "2025-09-25T15:20:29.870Z",
"dateUpdated": "2026-04-28T16:13:55.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}