A Cross‑Site Request Forgery flaw exists in the WordPress WP Business Hours plugin that permits an attacker to force authenticated users to submit malicious data, resulting in a stored cross‑site scripting condition. The flaw relies on the plugin’s lack of proper CSRF protection and inadequate input filtering, enabling unauthorized code execution in a victim’s browser when the data is displayed. The primary consequence is the compromise of the affected site’s integrity and the possible theft or manipulation of user data.

The vulnerability affects the Mejar WP Business Hours plugin for WordPress, with all releases up to and including version 1.4 susceptible. Any WordPress installation that has not upgraded past version 1.4 is exposed.

The CVSS score is 7.1, categorizing the risk as high. The EPSS score is listed as <1%, indicating a low probability of exploitation, and the vulnerability is not present in the CISA KEV catalog. The most probable attack vector involves a crafted web request sent from a compromised user’s browser or a malicious link, exploiting the plugin’s missing CSRF token on state‑changing operations. Successful exploitation would lead to stored XSS, enabling attackers to run arbitrary scripts in the context of the site’s users.