HivePress CVE-2026-109388

Exploitation requires three concrete conditions: (1) the attacker holds at least subscriber-level authenticated access (PR:L) on the target site; (2) the site administrator has enabled the user listing submission feature - a non-default deployment setting without which the attack surface does not exist; and (3) a victim subsequently logs in via the embedded login form on the attacker-controlled listing page, at which point the stored payload in the 'message' parameter executes. Limiting factors: the required subscriber authentication, the required non-default listing-submission configuration, and the dependency on a victim interacting with/logging in on the malicious listing page all meaningfully constrain realistic exploitation despite the network attack vector.

This is a medium-severity stored XSS (CVSS 6.4, CWE-79) that should be treated as a moderate, conditional priority rather than an urgent emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold subscriber-level (authenticated) access - this is NOT an unauthenticated flaw. The scope change (S:C) and low confidentiality/integrity impact correctly reflect that injected script executes in a different security context (another user's authenticated session/browser). No EPSS score, CISA KEV listing, or POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Crucially, the description adds a limiting condition absent from the raw CVSS: exploitation only works when the administrator has enabled user listing submission - a non-default dependency that materially reduces real-world exploitability and arguably warrants higher attack complexity than AC:L suggests. Net: a legitimate issue worth patching on normal cadence, but the authentication requirement plus the required non-default configuration make it lower real-world risk than the network/low-complexity metrics alone imply.

An attacker registers a free subscriber account on a HivePress site that allows user listing submissions, then submits a listing whose 'message' parameter carries a malicious script payload that is stored unsanitized. When a victim later logs in via the embedded form on the attacker's listing page, the stored script executes in the victim's authenticated browser session, enabling session/credential theft or actions on the victim's behalf. No public exploit code is identified at time of analysis.