BaseFortify

Publication date: 2025-10-27

Last updated on: 2026-04-27

Assigner: Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS.This issue affects WP Business Hours: from n/a through <= 1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62934

Affected Vendors & Products

Vendor	Product	Version / Range
mejar	wp_business_hours	1.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Mejar WP Business Hours plugin (version 1.4 and earlier). It allows an attacker to perform unauthorized actions on behalf of a logged-in user, which can lead to Stored Cross-Site Scripting (XSS). Stored XSS means malicious scripts can be permanently stored on the website and executed when other users access the affected pages.

Impact Analysis

This vulnerability can allow attackers to inject malicious scripts into the website, potentially compromising user accounts, stealing sensitive information, or performing unauthorized actions. It can also damage the website's reputation and trustworthiness by exposing users to malicious content.

Hi! I’m here to help you understand CVE-2025-62934. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70