7.1Alta

CVE-2026-112869WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Noah Hearle We’re Open! Publicada: 2026-10-24 11:00 (hace 10 días)

Descripción

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Noah Hearle	We’re Open!	≤ 2.6

Referencias y parches

https://patchstack.com/database/wordpress/plugin/opening-hours/vulnerability/wordpress-we-re-open-plugin-2-6-… vdb-entry

Puntuación CVSS

7.1Alta

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Requerida
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Bajo

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Todas las puntuaciones (2)

cna	CVSS 3.1	7.1Alta
audit@patchstack.com	CVSS 3.1	7.1Alta

EPSS (probabilidad de explotación en 30 días)

0.20%

superior al 10 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-10-19
Publicada2026-10-24 11:00
Llegó a IP-DB2026-10-24 23:25
Última actualización2026-10-26 16:41

Asignada por (CNA): Patchstack
Estado en NVD: Deferred

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

8.8Alta

CVE-2026-76124 hace 4 horas

BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint

BuddyBoss BuddyBoss App

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type h…

5.3Media

CVE-2026-91075 hace 8 horas

Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass

Eupago Gateway For Woocommerce

The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark…

5.3Media

CVE-2026-103327 hace 8 horas

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret

CryptoCloud

The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthe…

Sin puntuación

CVE-2026-103379 hace 11 horas

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

WATI Chat and Notification

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order…

Sin puntuación

CVE-2026-104647 hace 11 horas

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

weMail

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as autho…

Sin puntuación

CVE-2026-104648 hace 11 horas

weMail <= 2.1.6 - Editor+ API Key Disclosure

weMail

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credentia…