What is the CVSS score of CVE-2026-1822?

CVE-2026-1822 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1822?

Organizations using all should be aware of moderate risk from CVE-2026-1822, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1822?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1822

EUVD-2026-14008 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-rjxq-f5q8-7r4g

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14008

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The WP NG Weather plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ng-weather' shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 1.0.9 are affected, allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript that executes when users visit pages containing the malicious shortcode. With a CVSS score of 6.4 and network-accessible attack vector, this vulnerability poses a moderate risk to WordPress installations using this plugin.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental web application security flaw affecting server-side template rendering. The WP NG Weather plugin (CPE: cpe:2.3:a:tonysamperi:wp_ng_weather:*:*:*:*:*:*:*:*) fails to properly sanitize and escape shortcode attributes before rendering them in page templates. Code review of the affected versions (specifically wp-weather.php line 49 and templates/app.php line 5 per plugin repository references) reveals that user input passed through the shortcode parser is rendered directly into the DOM without WordPress escaping functions like esc_attr() or wp_kses_post(). This allows attackers to break out of attribute context and inject arbitrary HTML and JavaScript payloads that execute in the browsers of site visitors.

RemediationAI

Site administrators should immediately upgrade the WP NG Weather plugin to a version later than 1.0.9 if available from the plugin developer (version status should be verified at https://plugins.trac.wordpress.org/browser/wp-ng-weather or the official WordPress.org plugin page). If no patched version is available, consider disabling or removing the plugin entirely until a security update is released. As an interim mitigation, restrict the 'ng-weather' shortcode usage to pages edited only by fully trusted administrators, and audit all existing pages using this shortcode for injected content. Additionally, implement WordPress user role restrictions to limit contributor-level access to only necessary personnel, and monitor page edit logs for suspicious activity. Keep WordPress and all plugins updated to ensure core security patches for related XSS protections are in place.