The WS Theme Addons plugin for WordPress allows stored cross‑site scripting through its_weather shortcode because user‑supplied attributes are not properly sanitized or escaped. An attacker who can authenticate with contributor access or higher can inject arbitrary JavaScript that will run when anyone views a page containing the malicious shortcode. This vulnerability is a classic input validation flaw (CWE-79) and can lead to data theft, credential compromise, or further site compromise.

Vendors and products impacted are Wen Solutions’ WS Theme Addons plugin for WordPress, specifically all versions up to and including 2.0.0. No additional version details are provided in the advisory.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of < 1% suggests a low exploitation probability at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely observed in the wild. The likely attack vector is an authenticated contributor or higher user who can modify page content to insert a malicious shortcode. If exploitation succeeds, the attacker can execute scripts in the context of any user who views the affected content, potentially compromising account credentials and sensitive data.