Medium severity6.4NVD Advisory· Published Sep 14, 2023· Updated Apr 8, 2026
CVE-2023-4944
CVE-2023-4944
Description
The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
1- cpe:2.3:a:awesome_weather_widget_project:awesome_weather_widget:*:*:*:*:*:wordpress:*:*Range: <=3.0.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.wordfence.com/threat-intel/vulnerabilities/id/3bf77988-370b-437f-83a0-18a147e3e087nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/awesome-weather/tags/3.0.2/awesome-weather.phpnvdIssue Tracking
- plugins.trac.wordpress.org/browser/awesome-weather/tags/3.0.2/awesome-weather.phpnvdIssue Tracking
News mentions
0No linked articles in our index yet.