HivePress CVE-2026-103520

Two conditions must hold simultaneously: (1) the attacker holds an authenticated subscriber-level (or higher) account, implying the site permits user registration/listing submission; and (2) an administrator has configured a HivePress Text attribute whose display format places the %value% token inside an HTML attribute (e.g. title="%value%") - a documented but non-default HivePress pattern. Exploitation is NOT possible against a default configuration where %value% is rendered as normal element text. Limiting factors: requires valid authentication (not anonymous), requires that specific attribute display configuration, affects only versions ≤1.7.31 (fixed in 1.7.32), and the payload fires only when a user subsequently views the injected page.

This is a moderate-risk, conditionally-exploitable stored XSS (CWE-79) rather than a top-tier emergency. The Wordfence CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates a network-reachable, low-privilege (PR:L, i.e. authenticated subscriber-and-above) flaw with scope change (S:C) reflecting script execution in other users' browser contexts, with limited confidentiality/integrity impact and no availability impact. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent (low privilege, limited impact, no active-exploitation evidence), but one caveat matters: the description states exploitation is ONLY possible when an administrator has configured a Text attribute whose display format embeds the %value% token inside an HTML attribute (e.g. title="%value%"). This non-default precondition is not reflected in the AC:L rating; a more honest reading raises attack complexity because a required condition lies outside the attacker's control. Net: a genuine but gated vulnerability - a real priority only for sites that both allow self-registration (subscriber accounts) and use that specific attribute display configuration. Verify your own configuration before treating it as high priority.

An attacker registers a free subscriber account on a HivePress-powered directory site whose administrator has configured a Text attribute rendering %value% inside an HTML attribute. The attacker submits a user-defined field value containing a payload that breaks out of the HTML attribute context; it is stored unsanitized and then executes in the browser of any visitor - including administrators - who views the affected page. No public exploit code was identified in the provided data.