CVE-2026-125815: WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability

Q: Who can exploit this issue?

The vulnerability is remotely exploitable without authentication or user interaction, based on the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Q: What security impact is indicated?

Successful exploitation may expose a limited amount of confidential information. The supplied vector indicates no integrity or availability impact (C:L/I:N/A:N).

Q: Which plugin versions are affected?

The affected range is stated as We’re Open! versions through 2.8. No fixed version is provided in the available data.

Q: What should teams do if they use this plugin?

Identify installations of Noah Hearle’s We’re Open! plugin at version 2.8 or earlier and check the vendor or referenced advisory for remediation guidance. The available data does not provide a workaround or patch version.

Published Nov 13, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8.

Affected Software

1 affected component

Noah Hearle We’re Open!<=2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.9

Event History

Nov 13, 2026

CVE Published

via MITRE·12:50 PM

Data Sourced

via MITRE·12:50 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is remotely exploitable without authentication or user interaction, based on the CVSS vector (AV:N/AC:L/PR:N/UI:N).

What security impact is indicated?

Successful exploitation may expose a limited amount of confidential information. The supplied vector indicates no integrity or availability impact (C:L/I:N/A:N).

Which plugin versions are affected?

The affected range is stated as We’re Open! versions through 2.8. No fixed version is provided in the available data.

What should teams do if they use this plugin?

Identify installations of Noah Hearle’s We’re Open! plugin at version 2.8 or earlier and check the vendor or referenced advisory for remediation guidance. The available data does not provide a workaround or patch version.

CVE-2026-125815: WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What security impact is indicated?

Which plugin versions are affected?

What should teams do if they use this plugin?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What security impact is indicated?

Which plugin versions are affected?

What should teams do if they use this plugin?