The vulnerability in the Wetterwarner plugin is a stored cross‑site scripting (CWE‑79) flaw that allows an attacker to store malicious script code within the plugin’s data. When that data is rendered in web pages, the injected script runs in the browsers of site visitors. This can lead to session hijacking, theft of user credentials, or redirection to phishing sites. The flaw arises from the plugin’s failure to properly neutralize user input before page generation, directly exposing the site to client‑side attacks.

WordPress sites using the Tim Wetterwarner Wetterwarner plugin version 2.7.3 or earlier are impacted. Admins of such sites should check the plugin version and the WordPress installation to confirm that the vulnerable module is present.

The vulnerability carries a CVSS score of 5.9, indicating moderate severity, and an EPSS score of less than 1%, implying a low likelihood of exploitation under current conditions. Although it is not listed in the CISA KEV catalog, the exposed attack vector is remote via the web interface, letting an attacker submit malicious content that is later served to site visitors.