CVE-2021-24593: Business Hours Indicator Project Business Hours Indicator

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue

Affected products

• Business Hours Indicator Project Business Hours Indicator: before 2.3.5 (fixed in 2.3.5)

Published 2021-08-30. Last modified 2026-06-17.