The vulnerability is a contributor‑supplied cross‑site scripting flaw that allows unsanitized input to be stored by the WordPress Location Weather plugin and later rendered as part of a web page. An attacker who can add or edit location data can inject JavaScript that executes in the browsers of visitors to pages that display that data, potentially leading to session hijacking, data theft, or site defacement.

The flaw affects WordPress sites that use the Location Weather plugin from ShapedPlugin LLC, version 3.0.6 or earlier. The plugin processes contributor data without proper output encoding, enabling malicious script injection.

The CVSS score of 6.5 places the vulnerability in the medium severity range. The EPSS score indicates a very low probability of exploitation (<1%), and the issue is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation. The likely attack vector is remote, via the web interface that accepts contributor data. While the exploit does not grant full code execution, it can compromise any visitor’s browser session and can be used to deface or redirect content.