CVE-2026-112869: WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress We’re Open! opening-hoursto a version that resolves this vulnerability.Fixed in 2.7
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must persuade a user to interact with a crafted request or page, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required, and the attack can be conducted over the network.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability at low impact. The scope may extend beyond the vulnerable plugin's security authority, as indicated by the changed scope in the CVSS vector.
Which plugin versions are affected?
We’re Open! versions through 2.6 are affected. The available data does not identify a fixed version.