Vulnerability · Published Aug 2, 2021 · Assigned by WPScan
CVE-2021-24474Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS)
Medium 6.1
In plain English
A medium-severity cross-site scripting in Awesome Weather Widget from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.7%top 45.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Awesome Weather Widget | 3.0.2 – through 3.0.2 |
Weakness: CWE-79