CVE-2026-125815

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8...

EUVD-2026-125280

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8...

CVE-2026-125815 WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8...

CVE-2026-125815

The We’re Open! WordPress plugin (versions up to 2.8 ) is vulnerable to a Content Injection flaw, specifically identified as an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) . This vulnerability exists within the opening-hours component and allows for Code Injectio...

CVE-2026-112869

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6...

EUVD-2026-109248

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6...

CVE-2026-112869

The Noah Hearle We’re Open! WordPress plugin is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in versions n/a through 2.6 . The flaw stems from the Improper Neutralization of Input During Web Page Generation , which could allow an attacker to execute scripts in a use...

CVE-2026-112869 WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6...

CVE-2026-112869 WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6...

PT-2026-122521

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6...

CVE-2022-4752

The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2025-6527

Name of the Vulnerable Software and Affected Versions Open Hours – Easy Opening Hours plugin for WordPress versions up to and including 1.0.9 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'open-hours-current-statu...

CVE-2024-12813: Improper Neutralization of Input During Web Page Generation

The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2022-4752

The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4752 Opening Hours <= 2.3.0 - Contributor+ Stored XSS via Shortcode

The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4752

The CVE-2022-4752 entry concerns the WordPress plugin Opening Hours (

PT-2023-15385

Name of the Vulnerable Software and Affected Versions The Opening Hours WordPress plugin versions prior to 2.3.1 Description The issue concerns a lack of validation and escaping of certain shortcode attributes in the plugin, which could allow users with the contributor role and above to perform...

CVE-2022-4752: Improper Neutralization of Input During Web Page Generation

The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Plugin Opening Hours: Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

WordPress Opening Hours Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Opening Hours Type Plugin Vulnerable versions = 2.3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ba2ed69ebc49 Credits Unknown Required privilege Administrat...