CVE-2026-1822: WP NG Weather Plugin XSS Vulnerability

CVE-2026-1822 Overview

The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's ng-weather shortcode in all versions up to, and including, 1.0.9. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with contributor privileges can inject persistent malicious scripts that execute in the browsers of all users visiting affected pages, potentially leading to session hijacking, credential theft, or website defacement.

Affected Products

• WP NG Weather plugin for WordPress versions up to and including 1.0.9
• WordPress sites using vulnerable versions of the WP NG Weather plugin
• Any WordPress installation with contributor-level or higher user accounts using the affected plugin

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-1822 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-1822

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the WP NG Weather plugin's shortcode implementation. The ng-weather shortcode fails to properly sanitize and escape user-supplied attribute values before rendering them in the page output. When a user with at least contributor-level access creates or edits a post containing a malicious shortcode, the injected script payload is stored in the WordPress database and subsequently executed in the browser of any user who views the affected page.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack can be executed over the network without requiring user interaction once the malicious content is injected. Due to the changed scope characteristic of this vulnerability, the injected scripts can affect users beyond the vulnerable component's security context.

Root Cause

The root cause lies in the plugin's failure to implement proper input sanitization and output escaping mechanisms for shortcode attributes. Specifically, the vulnerable code paths can be found in the app.php template file and the main wp-weather.php plugin file. When processing the ng-weather shortcode, user-supplied attribute values are directly incorporated into the HTML output without adequate sanitization, allowing malicious JavaScript code to be rendered and executed.

Attack Vector

The attack requires an authenticated user with at least contributor-level privileges on the WordPress site. The attacker crafts a post or page containing the ng-weather shortcode with malicious JavaScript payload embedded in one of the shortcode attributes. When this content is saved, the malicious script is stored in the database. Subsequently, any user (including administrators) who views the page will have the malicious script execute in their browser context.

The attack does not require any user interaction beyond simply viewing the page containing the malicious shortcode. The stored nature of this XSS vulnerability makes it particularly dangerous as it can affect multiple users over an extended period until the malicious content is discovered and removed.

Detection Methods for CVE-2026-1822

Indicators of Compromise

• Unusual JavaScript code embedded within ng-weather shortcode attributes in posts or pages
• Unexpected network requests originating from WordPress pages containing weather widgets
• User reports of unusual browser behavior when viewing pages with weather functionality
• Database entries containing suspicious script tags within shortcode parameters

Detection Strategies

• Review WordPress database for posts and pages containing ng-weather shortcodes with suspicious attribute values
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Monitor browser console logs for JavaScript errors or unexpected script execution related to weather plugin content
• Audit contributor and author account activities for unusual post creation or modification patterns

Monitoring Recommendations

• Enable WordPress security logging to track shortcode usage and modifications
• Configure web application firewall (WAF) rules to detect XSS patterns in shortcode attributes
• Monitor for outbound connections to suspicious domains from pages containing the weather plugin
• Implement file integrity monitoring on plugin files to detect unauthorized modifications

How to Mitigate CVE-2026-1822

Immediate Actions Required

• Update the WP NG Weather plugin to a patched version when available from the WordPress plugin repository
• Audit all existing posts and pages using the ng-weather shortcode for malicious content
• Review user accounts with contributor-level access or higher for unauthorized activities
• Consider temporarily disabling the WP NG Weather plugin until a security patch is released

Patch Information

Organizations should monitor the Wordfence Vulnerability Report for patch availability and update information. The vulnerable code locations have been identified in the app.php template and the main plugin file. A proper fix should implement wp_kses() or esc_attr() functions to sanitize shortcode attribute outputs.

Workarounds

• Restrict contributor-level and author-level account creation to trusted users only
• Implement a Web Application Firewall (WAF) with XSS filtering capabilities
• Use WordPress security plugins that can scan for and block malicious shortcode content
• Temporarily remove or disable the WP NG Weather plugin if it is not business-critical

# Configuration example
# Disable WP NG Weather plugin via WP-CLI until patched
wp plugin deactivate wp-ng-weather --allow-root

# Search for potentially malicious ng-weather shortcode usage in database
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[ng-weather%script%'" --allow-root

# Enable WordPress debug logging to monitor suspicious activity
# Add to wp-config.php:
# define('WP_DEBUG', true);
# define('WP_DEBUG_LOG', true);
# define('WP_DEBUG_DISPLAY', false);