HivePress CVE-2026-109193

Exploitation requires that a site administrator has configured a custom user attribute (e.g. hp_custom_link) with a display_format template that places the %value% token inside an href, src, or style HTML attribute context - a documented but non-default use of the plugin's attribute display feature. Given that precondition, an unauthenticated attacker (PR:N) can inject the payload via the attribute value with no user interaction to store it, and the script fires when any user views a page rendering the attribute. The primary limiting factor is that configuration: sites without a custom user attribute rendering %value% into an href/src/style context are not exploitable, which substantially reduces the realistic affected population despite the network, unauthenticated vector.

This is a stored XSS (CWE-79) in the HivePress WordPress plugin, reported and triaged by Wordfence with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The vector's PR:N indicates an unauthenticated attacker and S:C reflects the cross-context execution typical of XSS, which is what elevates this from a Medium to a High score. However, the signals are mixed on real-world urgency: no EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. Most importantly, the description states a hard precondition that the CVSS AC:L does not capture: an administrator must have configured a custom user attribute whose display_format template places the %value% token inside an href/src/style attribute context. This operator-dependent, non-default configuration meaningfully narrows the real attack surface, so despite the 7.2/High rating this is better characterized as a conditional High rather than a universally exploitable flaw - I assess AC:H to reflect that precondition (see assessed vector). Net: a legitimate issue worth patching, but lower practical priority than its score suggests for sites not using that attribute-display configuration.

On a HivePress site where an admin has configured a custom user attribute (e.g. hp_custom_link) whose display template renders the %value% token inside an href, src, or style attribute, an unauthenticated attacker populates that attribute via their user profile with a crafted value that breaks out of the attribute context. When any visitor or administrator views a page displaying that attribute, the injected script executes in their browser session. No public exploit code was identified at time of analysis, but exploitation is straightforward once the vulnerable attribute configuration exists.