CVE-2021-24683

MEDIUM

Weather Effect WordPress Plugin < 1.3.4 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm

Description

The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/54f95b51-5804-4bee-9e4a-f73b8ef9bbd5

Scores

CVSS v3 5.4

EPSS 0.0040

EPSS Percentile 31.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CWE

CWE-352 CWE-79

Status published

Products (1)

awplife/weather_effect < 1.3.4

Published Oct 11, 2021

Tracked Since Feb 18, 2026