CVE-2021-24474: 
WordPress vulnerability analysis and mitigation

The Awesome Weather Widget WordPress plugin through version 3.0.2 contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-24474. The vulnerability was discovered by Truoc Phan and publicly disclosed on June 28, 2021. The issue affects the plugin's awesomeweatherrefresh AJAX action functionality (WPScan).

The vulnerability stems from improper sanitization of the 'id' parameter in the awesomeweatherrefresh AJAX action. This security flaw has been assigned a CVSS score of 7.1 (High) and is classified under CWE-79. The vulnerability can be triggered through a POST request to /wordpress/wp-admin/admin-ajax.php, requiring no authentication for exploitation (WPScan).

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions typically associated with XSS attacks (WPScan).

As of the last update, there is no known fix available for this vulnerability. The issue was reported to the WordPress plugins team on May 4th, 2021, and again on June 7th, 2021, due to lack of update. Users of the Awesome Weather Widget plugin should consider using alternative weather plugins until a security patch is released (WPScan).