We're Open! Plugin CVE-2026-112869

Exploitation requires the attacker to get a victim who has access to the affected 'We're Open!' plugin pages to open an attacker-crafted request/URL (UI:R) - the reflected payload is not stored, so there is no persistence and no server-side authentication is needed by the attacker (PR:N). The specific vulnerable parameter or input field is not described in the available sources. Key limiting factors: the attack fails without user interaction, affects only sites running the plugin at versions up to 2.6, and yields execution only in the victim's browser session rather than direct server compromise; impact is amplified if the lured victim is a privileged/administrator user.

This is a reflected cross-site scripting flaw (CWE-79) in the WordPress plugin 'We're Open!' (opening-hours) carrying a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector signals network-reachable, low-complexity exploitation requiring no attacker privileges but DOES require user interaction (UI:R) - the victim must be lured into triggering the reflected payload, which is the single largest brake on real-world risk. The scope change (S:C) and low C/I/A impacts are consistent with script execution in the victim's browser context rather than server compromise. No EPSS score is provided in the input, there is no CISA KEV listing, and no verified exploit code is supplied, so there is no public exploit identified at time of analysis. The only intelligence source is a Patchstack database advisory, and the vuln.today decision label is 'this_week' (not act_now/emergency), so this is a genuine but moderate, interaction-dependent priority rather than a mass-exploitation emergency. Note a mild tension to verify with the vendor: reflected XSS normally yields only low confidentiality/integrity impact, yet the vector claims A:L (availability) impact, which is atypical for reflected XSS and appears to reflect Patchstack's standard scoring template rather than a demonstrated denial-of-service.

An attacker crafts a URL for a site running the 'We're Open!' plugin that embeds a malicious script in a reflected parameter, then delivers it to a logged-in user (e.g. an administrator) via phishing or a planted link. When the victim opens the link, the unsanitized input is reflected into the generated page and executes in their browser, letting the attacker run script in the site's context - for example to hijack the session or perform actions as the victim. No public exploit was identified at time of analysis, and successful attack depends on the victim actually clicking the crafted link (UI:R).