The Store Hours for WooCommerce plugin suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping on URL parameters. This flaw allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a maliciously crafted link. The vulnerability affects all plugin versions up to 4.3.20. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user session data, perform actions on behalf of the user, or conduct phishing attacks. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links related to the Store Hours for WooCommerce plugin and consider disabling or removing the plugin if feasible. Monitoring vendor channels for updates is recommended.