EUVD-2025-28368CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.
AnalysisAI
CVE-2025-5015 is a stored/reflected cross-site scripting (XSS) vulnerability in AccuWeather and Custom RSS widget implementations that permits unauthenticated attackers to inject malicious scripts by replacing legitimate RSS feed URLs with attacker-controlled URLs. The vulnerability has a CVSS 3.1 score of 8.8 (High) with network-based attack vector requiring only user interaction, enabling attackers to achieve high confidentiality, integrity, and availability impact on affected systems. Given the network accessibility and low attack complexity, this represents a significant real-world risk for any platform hosting these widgets.
Technical ContextAI
This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), a client-side injection flaw where user-supplied input (RSS feed URLs) is not properly sanitized or validated before being rendered in the DOM. The AccuWeather and Custom RSS widget implementations likely use dynamic iframe generation or direct DOM manipulation to load RSS content without URL validation or content security policy enforcement. The attack surface exists because the widget accepts RSS feed URL parameters from untrusted sources without implementing URL scheme validation (e.g., restricting to http/https), HTML entity encoding, or DOM-based XSS protections. Affected CPE strings would typically follow patterns like 'cpe:*/weather_widget/accuweather*' and 'cpe:*/plugin/rss_widget*' depending on deployment context (WordPress plugins, web frameworks, CMS implementations).
RemediationAI
Immediate remediation steps: (1) Vendors must implement strict URL validation for RSS feed parameters, restricting to whitelisted URL schemes (http/https only) and optionally whitelisting known RSS providers, (2) Implement Content Security Policy (CSP) headers with 'script-src' restrictions to prevent inline script execution, (3) Apply HTML entity encoding/output encoding to all user-supplied input before DOM insertion, (4) Consider sandboxing RSS content in iframes with restricted permissions (allow-same-origin removal). For end-users/administrators: (1) Apply vendor security patches immediately upon availability (check AccuWeather and widget provider advisories), (2) Audit existing RSS feed URLs configured in widgets for suspicious entries, (3) Implement Content Security Policy at the web application level if not provided by widget vendors, (4) Disable or remove unused AccuWeather/RSS widgets from deployment. Workaround (temporary): Restrict RSS URL configuration to administrators only and implement approval workflow for URL changes before deployment.
Share
External POC / Exploit Code
Leaving vuln.today