This vulnerability (CVE-2024-35755) affects El tiempo Weather Widget Pro through version 1.1.40 and involves CWE-79: Improper Neutralization of Input During Web Page Generation, resulting in stored Cross-site Scripting (XSS). An attacker can inject malicious scripts that are stored and later executed in users' browsers when they load the affected widget. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network attack vector, low attack complexity, requires low privileges and user interaction, with scope changed and impacts on confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user session. This may allow attackers to execute arbitrary scripts in the context of users interacting with the widget, potentially leading to session hijacking, data theft, or other malicious actions. However, the impact is rated medium severity and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure to the vulnerable widget and applying web application firewall (WAF) rules that detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.