HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107657 · Microsoft / collected KEV context

cve-program · CVE-2026-107657

• https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=cve
• https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/helpers.php#L382
• https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-field.php#L561
• https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/fields/class-text.php#L197
• https://plugins.trac.wordpress.org/browser/hivepress/tags/1.7.31/includes/components/class-attribute.php#L1298
• https://github.com/hivepress/hivepress/releases/tag/1.7.32

No related operational record is retained in the current change model.