CVE-2023-5163 in Weather Atlas Widget Plugin
Summary
by MITRE • 11/22/2023
The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/11/2026
The Weather Atlas Widget plugin for WordPress presents a significant security vulnerability classified as CVE-2023-5163, affecting all versions up to and including 1.2.1. This vulnerability manifests as a stored cross-site scripting flaw within the plugin's shortcode implementation, specifically targeting the 'shortcode-weather-atlas' functionality. The issue arises from inadequate input sanitization and output escaping mechanisms that fail to properly validate or encode user-supplied attributes before processing them within the plugin's rendering logic. The vulnerability exists at the intersection of weak input validation and insufficient output encoding practices, creating an attack surface where malicious code can be persistently stored and executed.
The technical exploitation of this vulnerability requires an authenticated attacker possessing contributor-level privileges or higher within the WordPress environment. This permission level allows the malicious user to insert malicious payloads through the plugin's shortcode interface, which are then stored within the WordPress database. When other users access pages containing the compromised shortcode, the stored malicious scripts execute in their browsers, creating a persistent cross-site scripting attack vector. The vulnerability operates under CWE-79 which categorizes improper neutralization of input during web page generation, specifically addressing cross-site scripting flaws. This particular implementation represents a classic case where user-controllable input flows directly into the page output without adequate sanitization, making it a prime target for exploitation.
The operational impact of CVE-2023-5163 extends beyond simple script execution, as it enables attackers to perform various malicious activities including session hijacking, credential theft, data exfiltration, and redirection to malicious sites. The stored nature of the vulnerability means that the malicious scripts remain active until manually removed by administrators, potentially affecting multiple users over extended periods. Attackers could leverage this vulnerability to gain unauthorized access to user accounts, modify content, or establish persistent backdoors within the WordPress environment. The attack vector aligns with ATT&CK technique T1566.001 which covers "Phishing: Spearphishing Attachment" and T1566.002 for "Phishing: Spearphishing Link" as attackers can craft malicious shortcodes that appear legitimate to end users. This vulnerability particularly affects WordPress installations where contributors and higher-level users have access to the plugin's shortcode functionality.
Mitigation strategies for CVE-2023-5163 should prioritize immediate plugin updates to version 1.2.2 or later, which contain the necessary patches addressing the input sanitization and output escaping deficiencies. Administrators should also implement strict access controls limiting contributor-level permissions to only trusted individuals and consider implementing additional security measures such as content security policies to reduce the impact of potential exploitation. The vulnerability demonstrates the critical importance of proper input validation and output encoding practices, reinforcing the need for security-conscious development practices that adhere to OWASP Top Ten security guidelines. Organizations should also conduct regular security audits of their WordPress plugins and implement monitoring systems to detect unusual shortcode usage patterns that might indicate exploitation attempts.