National Weather Service Alerts
National Weather Service Alerts has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 8.1, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is PHP Remote File Inclusion, behind 1 of the records (100%).
The one issue recorded for National Weather Service Alerts has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. National Weather Service Alerts is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.9.31.
CVE-2025-52809National Weather Service Alerts <= 1.3.5 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records
National Weather Service Alerts
Author
John Russell
The National Weather Service Alerts plugin allows you to easily display weather alerts on your website. The alerts are pulled directly from the National Weather Service (http://alerts.weather.gov) based on the location that you specify and are then parsed, sorted, and output to your website. The alerts are then automatically updated using AJAX, based on the severity of the alerts for the specified location. The location can be set by using zipcode, city and state, or state and county. There is also the option to choose the scope of what alerts to include, such as alerts only for your county, alerts only for your state, or alerts for the entire United States. If applicable, a Google Map will be included with polygon overlays to show the affected regions of certain alert types, such as tornado warnings or flash flood warnings. Currently the National Weather Service Alerts plugin only works for areas within United States. However, the plugin expects Atom feeds that use the Common Alerting Protocol (CAP) format so in theory any CAP feed could be used. Features Shortcode Widget NWS Alerts settings page for adding the Alerts Bar Clean html5 markup CSS classes that make it easy to override default styles Developer API (filters) Weather Alerts Tornado Warning Severe Thunderstorm Warning Flash Flood Warning Flood Warning Blizzard Warning Winter Storm Warning Freeze Warning Dust Storm Warning High Wind Warning *The default weather alert types can be modified using the ‘nws_alerts_allowed_alert_types’ and ‘nws_alerts_sort_alert_types’ filter hooks.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C