Vulnerability feed

Executive summary

A cross-site scripting flaw affects the We're Open! opening-hours plugin for WordPress, versions 2.6 and earlier. The advisory rates it as medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor recommends updating the plugin to version 2.7 or later.

Technical summary

This is a reflected cross-site scripting (XSS) vulnerability classed as OWASP A3: Injection. The advisory states that it can be started by an unauthenticated user, but a privileged user must take an action such as clicking a malicious link or submitting a form for exploitation to succeed. Vulnerable versions are listed as 2.6 and earlier, and the patched version is 2.7. The advisory recommends updating to 2.7 or later and notes that Patchstack has issued a mitigation rule that blocks attacks until the update is applied. It does not state a manual workaround beyond that, nor does it state whether exploitation has been observed in the wild, and it gives no specific detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affects

Noah HearlePatchstackNoah Hearle We’re Open!Patchstack We're Open!