The vulnerability arises from insufficient sanitization of attributes supplied to the WP NG Weather shortcode, allowing an authenticated contributor or higher to persistently store malicious JavaScript in content pages. When a visitor opens a page containing the injected shortcode, the script executes in that visitor’s browser, potentially stealing credentials, defacing the site, or facilitating further attacks. The weakness is a classic stored cross‑site scripting flaw, corresponding to CWE-79.

All installations of the WP NG Weather plugin from the original release through version 1.0.9 are affected. The plugin is provided by tonysamperi under the WP NG Weather name and must be upgraded or removed to eliminate this flaw.

The CVSS v3 score of 6.4 indicates moderate severity. Established exploitation is likely limited to sites that grant contributor privileges, which may be common in collaborative blogs or news sites. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread active exploitation has not yet been reported. Nonetheless, the stored nature of the payload means any page visitor could be impacted, warranting prompt attention.