CVE-2026-109388

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109388
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109388.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109388
Published
2026-10-16T06:41:04Z
Modified
2026-10-28T02:30:23Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
Details

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has enabled user listing submission, and the script executes in the victim's browser at the moment of successful login via the embedded form on the attacker's listing page.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109388.json"
}
References

Affected packages

Git / github.com/hivepress/hivepress

Affected ranges

Type
GIT
Repo
https://github.com/hivepress/hivepress
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
bc3ad70bec7562be01641f8aecd0d6d499f5620a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.7.32"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.3.0
1.3.1
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.2
1.3.3
1.3.4
1.3.5
1.3.5.1
1.3.6
1.3.7
1.3.8
1.3.9
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.10
1.5.11
1.5.12
1.5.13
1.5.13.1
1.5.14
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.6.0
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.14.1
1.6.14.2
1.6.14.3
1.6.14.4
1.6.14.5
1.6.15
1.6.16
1.6.17
1.6.18
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.1.1
1.7.10
1.7.11
1.7.12
1.7.13
1.7.14
1.7.15
1.7.16
1.7.17
1.7.18
1.7.19
1.7.2
1.7.20
1.7.21
1.7.22
1.7.23
1.7.24
1.7.25
1.7.26
1.7.27
1.7.28
1.7.29
1.7.3
1.7.30
1.7.31
1.7.31.1
1.7.31.2
1.7.32
1.7.4
1.7.5
1.7.6
1.7.6.1
1.7.7
1.7.7.1
1.7.7.2
1.7.8
1.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109388.json"