Woc Open Close Vulnerabilities

The Open Close WooCommerce Store plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 4.9.8

Fix:

No patched version reported

Disclosed:

Oct 8, 2025

CVE-2025-62935 on NVD →

The Open Close WooCommerce Store plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.9.5. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code i...

CVSS:

8.8

Affected:

up to 4.9.5

Fix:

No patched version reported

Disclosed:

May 7, 2025

CVE-2025-47649 on NVD →

The Open Close WooCommerce Store – Best Business Schedules Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_switch_active and ajax_update_timezone functions in all versions up to, and including, 4.9.1. This makes it possible for authenticated...

CVSS:

4.3

Affected:

up to 4.9.1

Fixed in:

4.9.2

Disclosed:

Apr 15, 2024

CVE-2024-32522 on NVD →

The Woocommerce Open Close – Best Business Schedules Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a URL in versions up to, and including 4.3.0 due to insufficient sanitization and escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.1

Affected:

up to 4.3.0

Fixed in:

4.3.1

Disclosed:

Apr 17, 2022