A Cross-Site Request Forgery vulnerability in the Mejar WP Business Hours plugin allows an attacker to trigger stored Cross-Site Scripting, potentially leading to account takeover or malicious script injection.

The plugin contains a Cross-Site Request Forgery (CWE-352) vulnerability that allows an unauthenticated attacker to perform unauthorized actions by tricking an authenticated administrator into executing malicious requests, which results in Stored Cross-Site Scripting.

Successful exploitation of this vulnerability can lead to the unauthorized execution of scripts within the context of an administrator session. This poses a significant risk to the integrity and confidentiality of the WordPress site, as attackers could potentially modify site content, redirect users, or perform administrative tasks without authorization. Given the CVSS score of 8.8, this flaw represents a high-severity risk that requires prompt attention to prevent unauthorized administrative control.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official WordPress plugin repository for updates and disable the WP Business Hours plugin until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious POST requests originating from unexpected sources, particularly those targeting plugin configuration pages.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter out malicious requests and block common XSS patterns that may be injected via the CSRF vector.

Public Exploit Available: No (exploit_available: false).

This vulnerability presents a high risk due to the potential for administrative compromise via stored script injection. Organizations should prioritize removing or disabling the affected plugin until the vendor provides a verified security update, as CSRF-to-XSS chains are frequently leveraged to gain persistent access to WordPress environments.