The vulnerability allows an attacker to inject and store arbitrary malicious scripts within a custom user attribute of the HivePress plugin. When a user views a page that displays the affected attribute, the script executes in the victim’s browser. This Stored XSS can lead to unauthorized actions, data theft, or defacement, all without the attacker needing to authenticate to the WordPress site.

Any WordPress site that has installed HivePress version 1.7.32 or earlier and has at least one custom user attribute configured so that the %value% token is rendered inside an href, src, or style attribute. The issue does not depend on a specific operating system or server environment, as it is confined to the plugin’s PHP output handling.

The CVSS score of 7.2 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an administrator has created a custom attribute with a vulnerable display format; once set, any user visiting a page containing the attribute can trigger the stored script. Attackers can achieve code execution in victims’ browsers, gaining the ability to harvest credentials or carry out phishing attacks. Given the widespread use of the plugin, the risk level is significant for sites that meet the vulnerability criteria.