CVE-2026-112869 XSS in We're Open! WordPress Plugin

Reflected XSS in We're Open! plugin up to v.2.6. CVSS 7.1 (high). Public proof-of-concept discussed on GitHub.

CVE-2026-112869 is a Reflected Cross-site Scripting (XSS) vulnerability in the We're Open! WordPress plugin by Noah Hearle. The flaw allows an unauthenticated attacker to inject arbitrary JavaScript code through improperly neutralized input parameters during web page generation. Any site using We're Open! through version 2.6 is potentially exposed.

The vulnerability scored CVSS 7.1 (high severity). According to official NVD data published on October 24, 2026, the status of a fix is not reported by official sources. A public signal on GitHub (November 7, 2026) reports the existence of proof-of-concept code for exploitation, indicating the risk is being discussed in the security community.

For site defenders and WordPress administrators: if We're Open! is in use, immediately verify which version is installed and monitor official updates for a patch. In the interim, consider disabling or replacing the plugin if not critical; restrict access to plugin parameters via Web Application Firewall (WAF); deploy Content Security Policy (CSP) to mitigate injected code execution.

At a glance

What: Reflected Cross-site Scripting (XSS) in We're Open! WordPress plugin by Noah Hearle. Injects arbitrary JavaScript via unfiltered input parameters during page generation.
Severity: CVSS 7.1 (high). Allows arbitrary code execution in victim's browser context without authentication.
Affected versions: We're Open! from version not reported through 2.6 inclusive.
Fix: Not reported in NVD data. Monitor official plugin updates.
Status: Published on NVD October 24, 2026. Public signal on GitHub (November 7, 2026) reports proof-of-concept availability for exploitation.
Action: Verify installed version; monitor official patch; disable/replace plugin if not essential; implement WAF and CSP as temporary mitigation.

Sources: NVD, CVE-2026-112869

← All articles