CVE-2026-66433: Location Weather Plugin XSS Vulnerability

CVE-2026-66433 Overview

CVE-2026-66433 is a stored Cross-Site Scripting (XSS) vulnerability in the Location Weather plugin for WordPress, affecting versions up to and including 3.0.6. The flaw allows users with Contributor-level privileges to inject malicious JavaScript that executes when other users view the affected page. Exploitation requires authentication and user interaction, but the scope is changed, meaning injected scripts can affect resources beyond the vulnerable component. The vulnerability is classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session hijacking, credential theft, and administrative account takeover.

Affected Products

WordPress Location Weather plugin versions ≤ 3.0.6
WordPress sites permitting Contributor-level accounts using the plugin
Any environment where untrusted authors interact with the Location Weather shortcode or widgets

Discovery Timeline

2026-07-27 - CVE-2026-66433 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66433

Vulnerability Analysis

The Location Weather plugin fails to properly sanitize or escape user-supplied input rendered through plugin shortcodes or configuration attributes. A Contributor-level user can craft input containing JavaScript that is stored by the plugin and later reflected without adequate output encoding.

When an editor, administrator, or site visitor loads a page containing the malicious payload, the browser executes the injected script in the context of the site's origin. Because the CVSS vector indicates a changed scope, the impact extends beyond the plugin's own security domain and can reach other components within the WordPress instance.

Exploitation is feasible over the network with low attack complexity, but requires that the attacker hold at least Contributor privileges and that a victim interact with the affected content. The EPSS probability for this vulnerability is 0.13%.

Root Cause

The root cause is insufficient input validation and output escaping when rendering weather-related content supplied through plugin fields. User-controlled values are placed into HTML contexts without applying WordPress escaping helpers such as esc_attr(), esc_html(), or wp_kses().

Attack Vector

An authenticated Contributor submits content that includes a malicious payload through a Location Weather shortcode attribute or plugin field. The payload persists in the site database. When another user, typically a higher-privileged editor or administrator, previews or publishes content containing the shortcode, the script executes in their browser session. See the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-66433

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_posts, wp_postmeta, or plugin option tables associated with Location Weather.
New or modified WordPress administrator accounts created shortly after a Contributor edits Location Weather content.
Outbound HTTP requests from administrator browsers to attacker-controlled domains following page views of Location Weather content.

Detection Strategies

Audit plugin-related database entries for HTML or JavaScript content submitted by Contributor accounts.
Review WordPress activity logs for suspicious edits from low-privilege users to posts containing Location Weather shortcodes.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages rendering the plugin.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record post revisions, user role changes, and plugin setting modifications.
Alert on privilege escalation events, including new administrator accounts or role promotions following Contributor activity.
Track anomalous session behavior for administrator accounts, such as logins from new IP addresses immediately after content review.

How to Mitigate CVE-2026-66433

Immediate Actions Required

Update the Location Weather plugin to a version later than 3.0.6 once the vendor publishes a fix.
Restrict Contributor account creation and review existing low-privilege accounts for legitimacy.
Purge or sanitize any existing Location Weather content submitted by untrusted users.

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the latest fixed version guidance from the plugin vendor. Apply the fixed release across all WordPress sites running Location Weather.

Workarounds

Temporarily deactivate the Location Weather plugin until a patched version is installed.
Remove Contributor role assignments from untrusted users or downgrade them to Subscribers.
Deploy a Web Application Firewall (WAF) rule set that blocks XSS payloads in requests targeting WordPress admin endpoints.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

bash

# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate location-weather
wp plugin status location-weather