Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Awesome Weather Widget Project Clear all filters
TI-2023-04554 CVE-2023-4944 · GHSA-39fq-6jqh-4p29

Awesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 29

The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00486 Published 2023-09-14 No fix listed CWE-79
TI-2021-06762 CVE-2021-24474 · GHSA-wmqx-9h6r-8v2v

Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS)

Priority LOW 28

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00726 Published 2021-08-02 No fix listed CWE-79