HivePress – Business Directory, Listings & Classified Ads Plugin <= 1.7.32 - Authenticated (Subscriber+) Arbitrary CSS Injection

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.32. This is due to insufficient sanitization of user-controlled token values substituted into href, src, action, and style HTML attributes within field display templates, allowing javascript: URLs and arbitrary CSS to pass through unescaped. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary content including JavaScript URLs or CSS expressions into page output via field display templates, allowing code execution in the context of other users' browsers. An attacker must be able to submit listing or attribute field values that are rendered using a display template containing URL or style attributes.

An attacker needs Subscriber access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: HivePress 1.8.0 closes this, and updating the plugin is the step that ends it.

• Firewall
• Alerts