Hivepress Business Directory Listings Classified Ads Plugin
Monthly
Stored cross-site scripting in the HivePress Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows unauthenticated attackers to persist arbitrary JavaScript that executes whenever a user views a page rendering an affected custom user attribute. The published CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); our assessment retains that score but raises attack complexity to High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because exploitation depends on a site administrator having configured a custom user attribute whose display_format template places the %value% token inside an href, src, or style attribute context - a documented but non-default use of the plugin's attribute display feature. No public exploit identified at time of analysis, and although an upstream fix has been merged (PR #375 / changeset 3747070), the realistic affected population is limited to sites with such an attribute template already in place.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.31) allows unauthenticated attackers to inject arbitrary JavaScript into front-end user profiles by supplying a crafted value for a custom text-type user attribute, which then executes whenever a victim - including an administrator - views the injected profile page. Exploitation is gated on two administrator-controlled configuration choices: a text-type custom user attribute must use a display format that places %value% inside an HTML attribute context (the plugin's own documented pattern <a href="%value%">Custom link</a>), and front-end user profiles must be enabled; sites that do not meet both conditions are not exploitable despite the HIGH base score. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor fix is available in HivePress 1.7.32.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows an authenticated attacker with subscriber-level access or above to inject arbitrary web scripts through the 'message' parameter, which are then rendered to other users. Exploitation is conditional: the site administrator must have enabled user listing submission (a non-default setting), and a victim must subsequently log in through the login form embedded on the attacker's listing page for the payload to execute in their browser. This is a medium-severity issue (CVSS 6.4, CWE-79); no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so it should be treated as a moderate, conditional priority rather than an emergency.
Stored cross-site scripting in the HivePress WordPress plugin (Business Directory, Listings & Classified Ads) affects all versions up to and including 1.7.31 and allows authenticated users with subscriber-level accounts or higher to inject arbitrary JavaScript that executes when other users view the affected listing page. Exploitation is conditional, not universal: the site must permit subscriber-level registration or listing submission, and an administrator must have configured a HivePress Text attribute whose display format places the %value% token inside an HTML attribute (for example title="%value%"), which is a documented but non-default HivePress pattern - a default configuration that renders %value% as normal element text is not exploitable. The vendor has released 1.7.32, which includes the fix for escaping field and token values; no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). Independent assessment rates the practical severity as moderate and conditionally exploitable, with attack complexity assessed as High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) rather than the published AC:L rating.
Stored cross-site scripting in the HivePress Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows unauthenticated attackers to persist arbitrary JavaScript that executes whenever a user views a page rendering an affected custom user attribute. The published CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); our assessment retains that score but raises attack complexity to High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because exploitation depends on a site administrator having configured a custom user attribute whose display_format template places the %value% token inside an href, src, or style attribute context - a documented but non-default use of the plugin's attribute display feature. No public exploit identified at time of analysis, and although an upstream fix has been merged (PR #375 / changeset 3747070), the realistic affected population is limited to sites with such an attribute template already in place.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.31) allows unauthenticated attackers to inject arbitrary JavaScript into front-end user profiles by supplying a crafted value for a custom text-type user attribute, which then executes whenever a victim - including an administrator - views the injected profile page. Exploitation is gated on two administrator-controlled configuration choices: a text-type custom user attribute must use a display format that places %value% inside an HTML attribute context (the plugin's own documented pattern <a href="%value%">Custom link</a>), and front-end user profiles must be enabled; sites that do not meet both conditions are not exploitable despite the HIGH base score. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and a vendor fix is available in HivePress 1.7.32.
Stored cross-site scripting in the HivePress - Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows an authenticated attacker with subscriber-level access or above to inject arbitrary web scripts through the 'message' parameter, which are then rendered to other users. Exploitation is conditional: the site administrator must have enabled user listing submission (a non-default setting), and a victim must subsequently log in through the login form embedded on the attacker's listing page for the payload to execute in their browser. This is a medium-severity issue (CVSS 6.4, CWE-79); no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so it should be treated as a moderate, conditional priority rather than an emergency.
Stored cross-site scripting in the HivePress WordPress plugin (Business Directory, Listings & Classified Ads) affects all versions up to and including 1.7.31 and allows authenticated users with subscriber-level accounts or higher to inject arbitrary JavaScript that executes when other users view the affected listing page. Exploitation is conditional, not universal: the site must permit subscriber-level registration or listing submission, and an administrator must have configured a HivePress Text attribute whose display format places the %value% token inside an HTML attribute (for example title="%value%"), which is a documented but non-default HivePress pattern - a default configuration that renders %value% as normal element text is not exploitable. The vendor has released 1.7.32, which includes the fix for escaping field and token values; no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). Independent assessment rates the practical severity as moderate and conditionally exploitable, with attack complexity assessed as High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) rather than the published AC:L rating.