{"id":"CVE-2026-125815","kind":"vulnerability","aliases":["CVE-2026-125815"],"related":[],"title":"We're Open! WordPress plugin: basic XSS lets scripts inject into pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8.","summary":"The We're Open! opening-hours plugin for WordPress fails to neutralize script-related HTML tags, so input can inject code into web pages. An attacker who can get a crafted value into the plugin's output can run script in a visitor's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","we're open!","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `We're Open!` opening-hours plugin is installed on the WordPress site (Plugins list in wp-admin)\n- Compare the installed plugin version against `2.8`; anything at or below `2.8` is in the affected range","fix":"- We're Open! plugin: no fixed version named in the sources; unknown","status":"open","published_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","triaged_at":"2026-11-13T13:48:05+00:00","updated_at":"2026-11-13T13:48:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T13:48:05Z","model":"claude-haiku-5-5","output":{"fix":"- We're Open! plugin: no fixed version named in the sources; unknown","reach":"internet","title":"We're Open! WordPress plugin: basic XSS lets scripts inject into pages","impact":"medium","summary":"The We're Open! opening-hours plugin for WordPress fails to neutralize script-related HTML tags, so input can inject code into web pages. An attacker who can get a crafted value into the plugin's output can run script in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","we're open!"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the affected site","analyst_note":"Confirm the exact input path, whether authentication is required, and whether a fixed version above 2.8 exists, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-125815 and the plugin's WordPress.org page.","how_to_check":"- Check whether the `We're Open!` opening-hours plugin is installed on the WordPress site (Plugins list in wp-admin)\n- Compare the installed plugin version against `2.8`; anything at or below `2.8` is in the affected range\n- unknown whether a specific setting or feature is required to trigger it","plain_action":"","product_name":"We're Open!","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the We're Open! opening-hours WordPress plugin at version 2.8 or earlier are in the affected range. The sources do not say which page or input path is exploitable or whether an account is needed, so unknown what the exposure looks like beyond the version range.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00078,"input_tokens":4555,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125815':15A,18A '-2026':14A,17A '2.8':106C 'affect':99C 'allow':95C 'attack':51B 'basic':6A,83C 'browser':70B 'code':46B,96C 'craft':56B 'cve':13A,16A 'fail':34B 'get':54B 'hearl':88C 'hour':30B,94C 'html':40B,77C 'improp':71C 'inject':10A,45B 'injection.this':97C 'input':43B 'issu':98C 'let':8A 'n/a':104C 'neutral':36B,72C 'noah':87C 'open':3A,22B,27B,29B,91C,93C,102C 'opening-hour':28B,92C 'output':62B 'packag':19B 'page':12A,49B,82C 'plugin':5A,31B,60B 're':2A,21B,26B,90C,101C 'relat':39B,76C 'run':64B 'script':9A,38B,65B,75C 'script-rel':37B,74C 'tag':41B,78C 'valu':57B 'visitor':68B 'vulner':85C 'web':48B,81C 'wordpress':4A,23B,33B 'xss':7A,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the We're Open! opening-hours WordPress plugin at version 2.8 or earlier are in the affected range. The sources do not say which page or input path is exploitable or whether an account is needed, so unknown what the exposure looks like beyond the version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wereopen","wordpress"],"campaign_type":null,"search_a":"'-125815':15A,18A '-2026':14A,17A 'basic':6A 'cve':13A,16A 'inject':10A 'let':8A 'open':3A 'page':12A 'plugin':5A 're':2A 'script':9A 'wordpress':4A 'xss':7A","search_b":"'attack':51B 'browser':70B 'code':46B 'craft':56B 'fail':34B 'get':54B 'hour':30B 'html':40B 'inject':45B 'input':43B 'neutral':36B 'open':22B,27B,29B 'opening-hour':28B 'output':62B 'packag':19B 'page':49B 'plugin':31B,60B 're':21B,26B 'relat':39B 'run':64B 'script':38B,65B 'script-rel':37B 'tag':41B 'valu':57B 'visitor':68B 'web':48B 'wordpress':23B,33B","search_c":"'2.8':106C 'affect':99C 'allow':95C 'basic':83C 'code':96C 'hearl':88C 'hour':94C 'html':77C 'improp':71C 'injection.this':97C 'issu':98C 'n/a':104C 'neutral':72C 'noah':87C 'open':91C,93C,102C 'opening-hour':92C 'page':82C 're':90C,101C 'relat':76C 'script':75C 'script-rel':74C 'tag':78C 'vulner':85C 'web':81C 'xss':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125815","severity":null,"published_at":"2026-11-13T13:18:21+00:00","modified_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:52+00:00","fetched_at":"2026-11-13T13:46:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}