CVE-2026-66433

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-66433

CVE-2026-66433 affects the WordPress plugin Location Weather (versions <= 3.0.6). The vulnerability is a Cross Site Scripting (XSS) issue in that plugin/version. The CVE entry identifies the affected software, with a medium overall risk (CVSS 3.1 base score 6.5) from Patchstack data, noting ne...

EUVD-2026-49242

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-66433

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-66433 WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Location Weather versions = 3.0.6...

CVE-2026-66433: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

PT-2026-64962

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-7249

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

CVE-2026-7249

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

CVE-2026-7249 Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

CVE-2026-7249

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

CVE-2026-7249

The CVE-2026-7249 entry pertains to the WordPress Location Weather plugin (versions up to 3.0.2). It lacks capability checks in splw_update_block_options() and lwp_clean_weather_transients(), allowing authenticated contributors+ to disable all weather blocks and purge weather cache transients. Th...

CVE-2026-7249 Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

EUVD-2026-31404

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

WordPress plugin Location Weather 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-42727

Name of the Vulnerable Software and Affected Versions Location Weather versions prior to 3.0.3 Description The Location Weather plugin for WordPress allows unauthorized modification of data because the splw update block options and lwp clean weather transients functions lack capability checks...

CVE-2026-7249: Missing Authorization

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

WordPress Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget plugin <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging vulnerability

Missing Authorization to Authenticated Contributor+ Block Settings Modification and Cache Purging vulnerability discovered by momopon1415 in WordPress Plugin Location Weather versions = 3.0.2...