CVE-2023-0360: Location Weather < 1.3.4 - Contributor+ Stored XSS
Vulnerability summary
CVE-2023-0360 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in shapedplugin location_weather. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 13-02-2023PublishedVulnerability first disclosed.
- 20-03-2025Last modifiedVulnerability information updated.
Description
The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.54% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Shapedplugin1 product
- location_weather< 1.3.4
Unknown1 product
- location weather< 1.3.4
Wordpress1 product
- location-weather≤ 1.3.3 (fixed in 1.3.4)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/ba653457-415f-4ab3-a792-42640b59302bExploitVDB EntryTechnical DescriptionThird Party Advisory