The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress, in all releases through 1.7.32, is vulnerable to a stored cross‑site scripting flaw via the 'message' parameter. The input is not properly sanitized or escaped, allowing an attacker who owns a subscriber or higher‑privileged account to inject JavaScript. When a user logs in through the embedded form on an attacker‑controlled listing page, the stored script runs in the victim’s browser, potentially stealing sessions or performing other malicious actions. The weakness is classified as CWE‑79.

All installations of HivePress 1.7.32 and earlier that have user listing submission enabled are affected. The plugin is a WordPress component used for business directories, listings and classified ads.

The vulnerability carries a CVSS base score of 6.4, signifying moderate severity. EPSS data is not available, and the flaw is not currently listed in the CISA KEV catalog. The attack vector requires authenticated access with subscriber‑level privileges, and the site must allow user‑submitted listings. Once an attacker injects malicious code into the 'message' field, any visitor who logs in with the embedded form will be exposed to the script. Because of the authentication requirement, the overall risk is lower than an unauthenticated flaw but still significant for sites with many subscriber users.