The WP SimpleWeather plugin for WordPress, developed by matt_mcbrien, contains a stored cross-site scripting vulnerability (CVE-2025-25085) due to improper input neutralization during web page generation. This flaw affects all versions up to 0.2.5. Exploitation requires low privileges and user interaction but can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is tracked with a CVSS 3.1 base score of 6.5, reflecting medium severity. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability can allow an attacker to execute arbitrary script code in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The impact is limited by the requirement for user interaction and low privileges, but the vulnerability still poses a risk to affected installations of WP SimpleWeather up to version 0.2.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP SimpleWeather plugin if feasible, or applying any available temporary mitigations recommended by the vendor. Monitoring for updates from the vendor or trusted security sources is advised.