← Back

Awesome Weather Widget

awesome_weather_widget

Vendor: Awesome Weather Widget Project • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-4944
1Awesome Weather Widget Project
1Awesome Weather Widget
Jun 17, 2026
Sep 14, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escap...Show more
The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.Show less
CVE-2021-24474
1Awesome Weather Widget Project
1Awesome Weather Widget
Jun 17, 2026
Aug 2, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.