CVE-2024-12813

Name of the Vulnerable Software and Affected Versions Open Hours – Easy Opening Hours plugin for WordPress versions up to and including 1.0.9

Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'open-hours-current-status' shortcode. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

Recommendations For versions up to and including 1.0.9, update to a version higher than 1.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the 'open-hours-current-status' shortcode until a patch is available. Avoid using user-supplied attributes in the affected shortcode until the issue is resolved.