Shapedplugin
Shapedplugin Location Weather: vulnerabilities and CVEs
Shapedplugin Location Weather has 3 published vulnerabilities, 2 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs3
Last 12 months2
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-66433 | Medium (6.5) | 0.22% | — | Jul 27, 2026 | Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. |
| CVE-2026-7249 | Medium (4.3) | 0.35% | — | May 22, 2026 | The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all… |
| CVE-2023-0360 | Medium (5.4) | 0.54% | — | Feb 13, 2023 | The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor… |