This vulnerability (CVE-2026-66433) is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in cross-site scripting (XSS). It affects Location Weather plugin versions up to 3.0.6. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) shows that the attack requires network access, low attack complexity, low privileges, and user interaction, with a scope change and low impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor. The vulnerability is published and recognized but currently lacks a fix.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of confidentiality, integrity, and availability of the system. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component. However, the impact is rated as low on confidentiality, integrity, and availability, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider minimizing exposure by limiting privileges and user interactions that could trigger the vulnerability. Monitor vendor channels for updates and apply patches promptly once available.