{"id":"CVE-2026-112869","kind":"vulnerability","aliases":["CVE-2026-112869"],"related":[],"title":"We're Open! WordPress plugin: reflected XSS lets attackers run scripts in browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.","summary":"The We're Open! opening-hours WordPress plugin by Noah Hearle has a reflected cross-site scripting flaw in versions through 2.6. An attacker can get a victim's browser to run injected script by sending a crafted link.","severity":"high","cvss":7.1,"epss":0.00251,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-above-2.6"],"how_to_check":"- Check the installed version of We're Open! (opening-hours) in the WordPress admin plugin list, or run `wp plugin get opening-hours --field=version` if WP-CLI is available.\n- Confirm whether the plugin is active on any public page.","fix":"- Update the We're Open! (opening-hours) plugin to a version later than `2.6`, if a fixed release is published. Fixed version: unknown from the sources.","status":"open","published_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:31:10+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the We're Open! (opening-hours) plugin to a version later than `2.6`, if a fixed release is published. Fixed version: unknown from the sources.","reach":"internet","title":"We're Open! WordPress plugin: reflected XSS lets attackers run scripts in browsers","impact":"medium","summary":"The We're Open! opening-hours WordPress plugin by Noah Hearle has a reflected cross-site scripting flaw in versions through 2.6. An attacker can get a victim's browser to run injected script by sending a crafted link.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in a victim's browser on the site","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for the fixed version and which parameter is reflected; the sources do not give either.","how_to_check":"- Check the installed version of We're Open! (opening-hours) in the WordPress admin plugin list, or run `wp plugin get opening-hours --field=version` if WP-CLI is available.\n- Confirm whether the plugin is active on any public page.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-2.6"],"who_is_affected":"Sites running the We're Open! opening-hours WordPress plugin at version 2.6 or earlier are exposed. The exposure comes from the plugin reflecting unsanitised input into pages, so the risk is highest where the plugin is active on public pages. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3311,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112869':16A,19A '-2026':15A,18A '2.6':51B,102C 'affect':95C 'allow':91C 'attack':9A,53B 'browser':13A,59B 'craft':67B 'cross':44B,78C 'cross-sit':43B,77C 'cve':14A,17A 'flaw':47B 'generat':76C 'get':55B 'hearl':39B,84C 'host':23B 'hour':34B,90C 'improp':69C 'inject':62B 'input':72C 'issu':94C 'let':8A 'link':68B 'n/a':100C 'neutral':70C 'noah':38B,83C 'open':3A,31B,33B,87C,89C,98C 'opening-hour':32B,88C 'packag':20B 'page':75C 'plugin':5A,27B,36B 're':2A,30B,86C,97C 'reflect':6A,42B,92C 'run':10A,61B 'script':11A,46B,63B,80C 'self':22B 'self-host':21B 'send':65B 'site':45B,79C 'version':49B 'victim':57B 'vulner':81C 'web':74C 'wordpress':4A,24B,26B,35B 'wordpress-plugin':25B 'xss':7A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the We're Open! opening-hours WordPress plugin at version 2.6 or earlier are exposed. The exposure comes from the plugin reflecting unsanitised input into pages, so the risk is highest where the plugin is active on public pages. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112869","severity":null,"published_at":"2026-10-24T08:16:51+00:00","modified_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112869","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112869","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}