Wetterwarner
Wetterwarner has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Wetterwarner has a vendor fix available, so running the current release closes it.
All of these findings were reported by Nabil Irawan. Wetterwarner is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-32489Wetterwarner <= 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Wetterwarner
Author
Tim
Wetterwarner displays the official weather warnings of the German Weather Service (Deutscher Wetterdienst, DWD) for any warning region in Germany – from a district down to a single municipality. Features Block for the block editor and block widget areas, with live preview Shortcode [wetterwarner] for page builders and classic themes Classic widget for older themes More than 11,000 DWD warning regions (districts, municipalities, coasts, inland lakes) with a convenient search Colour coding by warning level, icons, validity period and expandable details with safety instructions Prior information (Vorabinformation) is marked as such Optional: current DWD warning map for Germany or a federal state Background updates and local caching – fast page loads and gentle on the data source Privacy friendly: visitors never connect to external servers, the warning map is served from your own site No jQuery or icon fonts in the frontend Website, documentation & Demo Wetterwarner Supporter license Wetterwarner is and remains free – with all features and the same official DWD data for everyone. It is developed and maintained in my spare time, and the Wetterwarner API that supplies the data to every installation has real running costs. The optional Wetterwarner Supporter license is a way to directly support that ongoing development and operation – and as a thank-you, it also gives your site a few practical extras: Faster updates: new warnings every 5 instead of 15 minutes Fallback server: if the main API is unavailable, your site automatically switches to a separate, independently hosted server Priority support via contact form or e-mail Launch offer: 19 € per year (regular price 29 € per year). One-time purchase for 12 months, no subscription, no automatic renewal. The license is tied to your website’s address and is activated automatically with the next update – no license key to copy. Get your Supporter license – or directly from “Settings > Wetterwarner” in your WordPress admin. External services This plugin relies on the Wetterwarner API (api.wetterwarner.de), a service operated by the plugin author. The API caches the official warnings of the German Weather Service centrally, so that not every website has to download the DWD data, which can be several megabytes in size. All requests are made server-side by your WordPress installation – every 15 minutes (every 5 minutes with a Supporter license), with all regions in use combined into a single request. Visitors of your website never connect to external servers. No data about the visitors of your website is transmitted. Optional: support development – Only if you explicitly agree (notice in the admin area or “Settings > Wetterwarner”), the address of your website as well as the plugin, WordPress and PHP versions are additionally sent with the regular request. You can revoke your consent at any time; the stored information is then deleted. Entries without contact are removed automatically after 90 days. Provider: Tim Knigge, IT93 – Privacy policy Weather data: Deutscher Wetterdienst, Frankfurter Straße 135, 63067 Offenbach, Germany – Terms of use, Privacy policy. Important notes This plugin does not replace an official source of information. The German Weather Service gives no guarantee for the availability of its data. All rights to warnings and maps remain with the Deutscher Wetterdienst; the maps are not altered in content. The plugin is intended for use in Germany. It is not affiliated with the mobile app of the same name. Credits Icons from Lucide (ISC license, warning triangle from Feather under the MIT license) – license texts in licenses/lucide.txt Warnings, warning maps and warning regions: Deutscher Wetterdienst, CC BY 4.0 wp-color-picker-alpha (GPLv2)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C