Aviation Weather from NOAA
Aviation Weather from NOAA has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 8.1, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Path Traversal, behind 1 of the records (100%).
The one issue recorded for Aviation Weather from NOAA has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by 0xd4rk5id3. Aviation Weather from NOAA is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.1.12.
CVE-2025-28980Aviation Weather from NOAA <= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Read the full analysisVulnerability Records
Aviation Weather from NOAA
Author
machouinard
Display METAR & TAF info from NOAA’s Aviation Digital Data Service Display up to 6 hours before now PIREPs up to 200sm Create multiple instances using either widget or shortcode WP-CLI Integration Gutenberg Block A new AWFN Block can be found in the Widgets section. Shortcode Usage: ( shown with defaults ) [adds_weather apts='KSMF' hours=2 show_metar=1 show_taf=1 show_pireps=1 show_station_info=1 radial_dist=100 title=''] Data is cached for 30 minutes using the WordPress Transients API. Included Filter Hooks: adds_kses: Array of permitted HTML tags. adds_custom_css: URL of a user-supplied stylesheet. Supplying a stylesheet in theme’s directory ( ‘css/aviation_weather_from_noaa.css’ ) will also override stylesheet. Styling Copy css/aviation_weather_from_noaa.css from plugin directory into theme directory, keeping that file structure. Make desired changes. Plugin will load this stylesheet instead of its own. Code and support available at GitHub
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C