WordPress Plugin Vulnerabilities

Weather Atlas Widget < 3.0.4 - Unauthenticated Cross-Site Scripting

Description

The plugin is vulnerable to Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.

Affects Plugins

Plugin icon
weather-atlas
Fixed in 3.0.4

References

CVE
CVE-2024-52472
URL
https://patchstack.com/database/wordpress/plugin/weather-atlas/vulnerability/wordpress-weather-atlas-widget-plugin-3-0-1-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
LVT-tholv2k
Verified
No
WPVDB ID
59a595e6-145f-408d-8b48-1b22036da4e8

Timeline

Publicly Published
2024-11-18 (about 1 year ago)
Added
2024-11-26 (about 1 year ago)
Last Updated
2025-07-15 (about 10 months ago)

Other

Published
Title
Published
2024-11-18
Title
Infinite Slider <= 2.0.1 - Reflected Cross-Site Scripting
Published
2025-01-24
Title
AI Chatbot for WordPress – Hyve Lite < 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-05-21
Title
LuckyWP Table of Contents < 2.1.5 - Admin+ Stored XSS
Published
2023-07-26
Title
Winters theme <= 1.4.3 - Reflected Cross-Site Scripting via Prototype Pollution
Published
2025-02-27
Title
Product Catalog Simple < 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode