HivePress CVE-2026-107657

Exploitation requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (the documented pattern <a href="%value%">Custom link</a>), AND for front-end user profiles to be enabled. The attacker needs no authentication beyond normal front-end profile submission. Limiting factors: both preconditions are specific, administrator-controlled configuration choices - sites that do not use custom text user attributes in attribute-context display formats, or that disable front-end profiles, are not exploitable despite the HIGH base score; exploitation is further gated on a victim subsequently viewing the injected profile page. The vendor characterizes this configuration as standard and documented, so it is plausibly common but not a guaranteed default.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a network-reachable, unauthenticated stored XSS with a scope change, consistent with CWE-79. However, this AC:L scoring conflicts with the description, which states exploitation REQUIRES two preconditions: an administrator must have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context, AND front-end user profiles must be enabled. These are real, verifiable environmental prerequisites, so practical attack complexity is higher than AC:L implies - the flaw is not exploitable against a bare default install, only against sites matching this (admittedly documented) configuration pattern. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis; the only exploitation signal is a Wordfence report plus the fix in release 1.7.32 ('Fixed escaping field and token values'). Net: a legitimate, patch-worthy stored XSS in a moderately deployed plugin, but it is a configuration-dependent HIGH rather than an actively-exploited emergency - prioritize patching for sites using custom user attributes, but it does not carry KEV/EPSS urgency signals.

On a HivePress directory site that has enabled front-end user profiles and configured a custom text user attribute rendering %value% inside an HTML attribute (e.g. <a href="%value%">), an unauthenticated attacker registers or edits a profile and submits a crafted value that breaks out of the attribute to inject script. The payload is stored and executes in the browser of any visitor - including administrators - who views the attacker's public profile page. No public exploit code is identified in the provided data; the issue was reported by Wordfence and fixed in 1.7.32.