HivePress vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 20269

Newest CVEs

• CVE-2026-123470

  WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability

  HivePress · HivePress

  Medium4.3
• CVE-2026-42707

  WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

  HivePress · HivePress Claim Listings

  Medium4.3
• CVE-2026-110887

  WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

  HivePress · HivePress

  Critical9.9
• CVE-2026-110885

  WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability

  HivePress · HivePress

  Medium6.5
• CVE-2026-109193

  HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value

  hivepress · HivePress – Business Directory, Listings & Classified Ads Plugin

  High7.2
• CVE-2026-109388

  HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode

  hivepress · HivePress – Business Directory, Listings & Classified Ads Plugin

  Medium6.4
• CVE-2026-107657

  HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

  hivepress · HivePress – Business Directory, Listings & Classified Ads Plugin

  High7.2
• CVE-2026-103520

  HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

  hivepress · HivePress – Business Directory, Listings & Classified Ads Plugin

  Medium6.4
• CVE-2026-18056

  HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

  hivepress · HivePress Authentication

  High7.5
• CVE-2025-60123

  WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability

  HivePress · HivePress Claim Listings

  Medium4.3