The vulnerability is a reflected Cross‑Site Scripting flaw that results from improper neutralization of user supplied data during web page generation. An attacker can inject and execute arbitrary script when a victim visits a crafted URL or submits data through the plugin’s interface. This can lead to session hijacking, defacement, or malicious content injection.

This issue affects the WordPress We’re Open! opening‑hours plugin, produced by Noah Hearle, for all installations running version 2.6 or earlier. Versions 2.7 and later contain the fix.

The CVSS score of 7.1 indicates a high impact. The EPSS score is not available, but the lack of KEV listing suggests no publicly known exploits yet. Attackers would need to construct a malicious URL or form submission that the plugin fails to sanitize, and the vulnerability is exploitable by any user who can access the affected page. As a reflected XSS, it can compromise any user who visits the page with a vulnerable query string or input field.