CVE-2023-0360 Location Weather < 1.3.4 - Contributor+ Stored XSS

The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0360 Location Weather < 1.3.4 - Contributor+ Stored XSS

The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0360

CVE-2023-0360 concerns the Location Weather WordPress plugin, prior to version 1.3.4. The issue is that certain block options are not properly validated or escaped before being output on a page or post, which can enable Stored XSS for users with the Contributor role or higher. The vulnerability i...

WordPress Location Weather Plugin < 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Location Weather Type Plugin Vulnerable versions 1.3.4 Fixed in 1.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0360 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1547b60d4821 Credits Lana Codes Required...