HivePress vulnerabilities
We track 4 vulnerabilities in HivePress products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest HivePress vulnerabilities
- 9.9 Critical severity
HivePress: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
- 7.2 High severity
HivePress – Business Directory, Listings &…: Improper Neutralization of Input During Web Page Generation
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to in
- 7.2 High severity
HivePress – Business Directory, Listings &…: Improper Neutralization of Input During Web Page Generation
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to
- 7.5 High severity
HivePress Authentication: Improper Authentication
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party id