Skip to content
OpenAdvisories

Vendor

HivePress

11 known vulnerabilities.

Products

HivePress – Business Directory, Listings & Classified Ads Plugin 4 HivePress Claim Listings 3 HivePress 3 HivePress Authentication 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-123470

    WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.

    HivePress HivePress
  • Medium 4.3
    CVE-2026-42707

    WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.

    HivePress HivePress Claim Listings
  • Medium 6.5
    CVE-2026-110885

    WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.

    HivePress HivePress
  • Medium 6.4
    CVE-2026-109388

    HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode

    The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output e…

    HivePress HivePress – Business Directory, Listings & Classified Ads Plugin Web / CMS
  • Medium 6.4
    CVE-2026-103520

    HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

    The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insu…

    HivePress HivePress – Business Directory, Listings & Classified Ads Plugin Web / CMS
  • Medium 4.3
    CVE-2025-60123

    WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.

    HivePress HivePress Claim Listings
  • Medium 4.3
    CVE-2025-60122

    WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.

    HivePress HivePress Claim Listings