Is CVE-2026-109193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109193 being exploited in the wild.

How severe is CVE-2026-109193?

High severity, with a CVSS score of 7.2, published 16 October 2026.

Which products and versions are affected?

HivePress – Business Directory, Listings & Classified Ads up to 1.7.32.

Is there a fix for CVE-2026-109193?

Yes: fixed in 1.7.33 (released October 14, 2026). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109193 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109193?

Check whether you run HivePress – Business Directory or Listings & Classified Ads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109193: HivePress Stored Cross-Site Scripting in custom user attributes

CVE-2026-109193 · Severity: high · CVSS 7.2 · Published 2026-10-16

HivePress is a WordPress plugin for business directories and classified ads that allows administrators to create custom user profile attributes. Attackers can inject malicious JavaScript into these attributes that executes when other users view affected pages, potentially stealing credentials or redirecting users to malicious sites. The vulnerability only affects installations where administrators have configured custom attributes with specific display formatting.

Vendors: HivePress.

Quick answers

Is CVE-2026-109193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109193 being exploited in the wild.
How severe is CVE-2026-109193?: High severity, with a CVSS score of 7.2, published 16 October 2026.
Which products and versions are affected?: HivePress – Business Directory, Listings & Classified Ads up to 1.7.32.
Is there a fix for CVE-2026-109193?: Yes: fixed in 1.7.33 (released October 14, 2026). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109193 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109193?: Check whether you run HivePress – Business Directory or Listings & Classified Ads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.7.33 (released October 14, 2026)

Technical details

Stored XSS vulnerability in the custom user attribute display functionality due to insufficient input sanitization and output escaping. When an administrator configures a custom attribute with a display_format template containing the %value% token in href, src, style, or action attributes, unauthenticated attackers can inject arbitrary JavaScript. The fix (merged Oct 14, 2026) adds proper escaping by splitting attribute contexts and applying context-appropriate escape functions (esc_url, esc_attr, safecss_filter_attr).

Affected products

HivePress HivePress – Business Directory, Listings & Classified Ads up to 1.7.32

Timeline

2026-10-16: disclosed: CVE-2026-109193 published
2026-10-14: patched: Fix merged via PR #375

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.