Stored Cross-Site Scripting in Awesome Weather Widget for WordPress

CVE-2023-4944

What is CVE-2023-4944?

The Awesome Weather Widget for WordPress plugin is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on attributes of the 'awesome-weather' shortcode. This flaw allows authenticated attackers, holding contributor-level permissions or higher, to inject malicious web scripts that execute when users access compromised pages, potentially leading to severe security consequences.

References