759 matches found
Personal Weather Station Dashboard 12 - Directory Traversal
Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext. id: CVE-2025-47423 info: name: Personal Weather...
Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting
The ultimate-weather plugin 1.0 for WordPress contains a cross-site scripting vulnerability. id: CVE-2014-4561 info: name: Ultimate Weather Plugin = 1.0 - Cross-Site Scripting author: daffainfo severity: medium description: The ultimate-weather plugin 1.0 for WordPress contains a cross-site...
EUVD-2026-87365
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single...
CVE-2025-47423
CVE-2025-47423 – Local File Inclusion in Personal Weather Station Dashboard 12lts Discovered by: Matthew Eagle Status: Public Disclosure Date Reported: 2025-05-05 CVE ID: CVE-2025-47423 🧩 Summary A Local File Inclusion LFI vulnerability in the Personal Weather Station Dashboard version 12lts allo...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
EUVD-2026-49242
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433
CVE-2026-66433 affects the WordPress plugin Location Weather (versions <= 3.0.6). The vulnerability is a Cross Site Scripting (XSS) issue in that plugin/version. The CVE entry identifies the affected software, with a medium overall risk (CVSS 3.1 base score 6.5) from Patchstack data, noting ne...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Location Weather versions = 3.0.6...
CVE-2026-66433: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
PT-2026-64962
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-15299
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...
EUVD-2026-42806
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...
CVE-2026-15299
CVE-2026-15299 : The Animation Addons for Elementor WordPress plugin is vulnerable to Stored Cross-Site Scripting in all versions up to 2.6.3 via the Weather widget’s weather_style and move_direction parameters. The root cause is insufficient output escaping in Weather widget render() (widgets/we...
CVE-2026-15299 Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...
CVE-2026-15299 Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...
CVE-2026-15299
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...
CVE-2026-15299: Improper Neutralization of Input During Web Page Generation
The Animation Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'weatherstyle' and 'movedirection' parameters of the Weather widget in all versions up to, and including, 2.6.3. This is due to insufficient output escaping in the Weather widget's render...