CVE-2026-109193

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-109388

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102791

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-115489

Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.33 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...

CVE-2026-109193: Improper Neutralization of Input During Web Page Generation

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-109388: Improper Neutralization of Input During Web Page Generation

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-115491

Name of the Vulnerable Software and Affected Versions HivePress – Business Directory, Listings & Classified Ads Plugin versions prior to 1.7.33 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

HivePress – Business Directory, Listing & Classified Ads Plugin Cross-site Scripting Vulnerability

HivePress – Business Directory, Listings & Classified Ads Plugin 1.7.32 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'message' parameter input and inadequate escaping of output data. It may allow authenticated attackers...

CVE-2026-107657

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103520

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

EUVD-2026-96097

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

CVE-2026-103520: Improper Neutralization of Input During Web Page Generation

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

CVE-2026-107657: Improper Neutralization of Input During Web Page Generation

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' ' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-109498

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute user-defined field name' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin HivePress versions = 1.7.31...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin HivePress versions = 1.7.31...

CVE-2026-10082

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

CVE-2026-10082

The Advanced Ads WordPress plugin (versions before 2.0.23 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to sanitize and escape the ad_args parameter within the the_ad shortcode before outputting it to the page. This allows users with Contributor roles or...

CVE-2026-10082

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...