Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: A WP Life Component: Weather Effect Clear all filters
TI-2021-06991 CVE-2021-24709 · GHSA-whpx-fg6m-254m

Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-10-11 Fixed in 1.3.6 CWE-79
TI-2021-06965 CVE-2021-24683 · GHSA-gmwg-m5q2-qr9g

Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting

Priority LOW 25

The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00412 Published 2021-10-11 Fixed in 1.3.4 CWE-352