Cross-Site Request Forgery Vulnerability in Mejar WP Business Hours Plugin
CVE-2025-62934

8.8HIGH

Key Information:

Vendor

WordPress
Status
WP Business Hours
Vendor
CVE Published:
27 October 2025

What is CVE-2025-62934?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Mejar WP Business Hours plugin, which can lead to Stored Cross-Site Scripting (XSS) attacks. When exploited, this vulnerability could allow attackers to perform unauthorized actions on behalf of users, leading to potential data compromise. This issue affects versions of the Mejar WP Business Hours plugin prior to 1.4, emphasizing the importance of immediate updates and security measures to mitigate risks.

Affected Version(s)

WP Business Hours <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/wp-b...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien | Patchstack Bug Bounty Program
JSON
.