CVE-2021-24683— Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting
Quick assessment
Affected
Unknown Weather Effect – Christmas Santa Snow Falling
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Weather Effect 1.3.4之前版本存在跨站脚本漏洞，该漏洞源于插件在保存其设置时没有任何CSRF检查，并且不验证或转义它们，这可能导致存储跨站脚本问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24683
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting
Source: CVE Program / CVE List V5
Vulnerability Description
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Weather Effect 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Weather Effect 1.3.4之前版本存在跨站脚本漏洞，该漏洞源于插件在保存其设置时没有任何CSRF检查，并且不验证或转义它们，这可能导致存储跨站脚本问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Weather Effect – Christmas Santa Snow Falling | 1.3.4 ~ 1.3.4 | - |
|
II. Public POCs for CVE-2021-24683
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24683
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24683 (1)
Same Patch Batch · Unknown · 2021-10-11 · 17 CVEs total
| CVE-2021-24737 | Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24720 | GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24719 | Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS) | |
| CVE-2021-24712 | Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS | |
| CVE-2021-24711 | Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF | |
| CVE-2021-24709 | Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24691 | Quiz And Survey Master < 7.3.2 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24690 | Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting | |
| CVE-2021-24681 | Duplicate Page <= 4.4.2 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24656 | Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting | |
| CVE-2021-24651 | Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection | |
| CVE-2021-24577 | Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS | |
| CVE-2021-24576 | Easy Accordion < 2.0.22 - Authenticated Stored XSS | |
| CVE-2021-24563 | Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting | |
| CVE-2021-24546 | EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution | |
| CVE-2021-24545 | WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-96173
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disc -
CVE-2026-96200
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confir -
CVE-2026-96255
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gatewa -
CVE-2026-89296
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Pa -
CVE-2026-87973
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS vi
Same weakness: CWE-352
-
CVE-2026-102399
WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cros -
CVE-2026-97299
WordPress Razorpay Payment Links for WooCommerce plugin <= 2 -
CVE-2026-96838
WordPress Blacklist Manager – WooCommerce Anti-Fraud, -
CVE-2026-95362
Chrome 154 DevTools跨站请求伪造漏洞 -
CVE-2026-73597
Dell SCG Policy Manager <5.34.00.16 CSRF漏洞
V. Comments for CVE-2021-24683
No comments yet