Vulnerabilities in HivePress
11 resultsCVE-2026-18056HIGHHivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook AuthenticatorEPSS 0.6%CVE-2026-109193HIGHHivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute ValueEPSS 0.4%CVE-2026-110887CRITICALWordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerabilityEPSS 0.4%CVE-2026-110885MEDIUMWordPress HivePress plugin <= 1.7.32 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-109388MEDIUMHivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form ShortcodeEPSS 0.2%CVE-2026-107657HIGHHivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration FormEPSS 0.2%CVE-2025-60122MEDIUMWordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-60123MEDIUMWordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-123470MEDIUMWordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-42707MEDIUMWordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-103520MEDIUMHivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML FormatEPSS 0.2%