CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

WordPress ultimate-weather cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Give is a fundraising platform plugin used in it. ghost is a plugin used in it for importing/exporting WordPress data. A cross-site...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

EUVD-2014-4488

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561

CVE-2014-4561 affects the WordPress Ultimate Weather Plugin (

Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS

The last time it was checked the plugin was still affected and had been closed. PoC http://www.example.com/wp-content/plugins/ultimate–weather–plugin/magpierss/scripts/magpiedebug.php?url=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...