The vulnerability CVE-2025-62934 affects the Mejar WP Business Hours plugin for WordPress (versions up to 1.4). It is a CSRF vulnerability that enables stored XSS attacks by allowing an attacker to trick an authenticated user into submitting a malicious request. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the available data.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of an authenticated user. This can compromise user data confidentiality, integrity, and availability within the affected WordPress site. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or applying manual mitigations such as implementing CSRF tokens and input sanitization if feasible. Monitor official Mejar communications for updates on patches or fixes.