Live › vulnerability › CVE-2026-112869
Go to dashboardThe We're Open! opening-hours WordPress plugin by Noah Hearle has a reflected cross-site scripting flaw in versions through 2.6. An attacker can get a victim's browser to run injected script by sending a crafted link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.
Sites running the We're Open! opening-hours WordPress plugin at version 2.6 or earlier are exposed. The exposure comes from the plugin reflecting unsanitised input into pages, so the risk is highest where the plugin is active on public pages. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get opening-hours --field=version if WP-CLI is available.2.6, if a fixed release is published. Fixed version: unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-112869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.