WP Business Hours CVE-2025-62934
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Requires user interaction (UI:R) and leads to stored XSS affecting other visitors, scope changed, low impacts.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS.This issue affects WP Business Hours: from n/a through <= 1.4.
AnalysisAI
Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.
Technical ContextAI
The underlying issue is CWE-352 (Cross-Site Request Forgery), which permits an attacker to forge requests on behalf of a logged-in administrator when they interact with a crafted URL. Because the plugin fails to validate the authenticity of state-changing requests, an attacker can manipulate plugin settings or content to store malicious JavaScript. This stored script (Stored XSS) executes in the context of users’ browsers when they access the compromised plugin interface. The affected code is in the WP Business Hours WordPress plugin (CPE not explicitly provided), as indicated by the Patchstack advisory.
Affected ProductsAI
WP Business Hours plugin for WordPress versions n/a through 1.4 are affected. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/wp-business-hours/vulnerability/wordpress-wp-business-hours-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve.
RemediationAI
Update the WP Business Hours plugin to version 1.5 or later, which addresses the CSRF vulnerability. If immediate update is not possible, temporarily disable the plugin until the patch is applied. Site administrators should exercise caution when clicking links while authenticated and consider implementing additional CSRF protections at the application level, though the patch is the definitive fix.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today