Panorama Viewer CVE-2026-115956

Requires an authenticated WordPress account with at least low-level privileges (PR:L - typically a contributor/author who can create or edit panorama content), because the stored payload is injected through a plugin input that is improperly neutralized. Exploitation is NOT self-triggering: a second user (administrator or visitor) must render the page/admin view containing the stored payload (UI:R) for the script to execute. Limiting factors: this is not remote-unauthenticated - sites that do not grant untrusted users content-creation accounts, or that restrict who can author panorama content, substantially reduce exposure; only versions through 1.8.3 are affected.

This is a moderate-severity Stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) affecting the bPlugins 'Panorama Viewer - 360 Degree Image + Video Viewer' WordPress plugin through version 1.8.3. The network attack vector and low complexity are offset by two real limiting factors: PR:L means an attacker must already be authenticated with at least low-level privileges (a contributor/author-type account), and UI:R means a victim must view the stored payload for it to fire. The scope change (S:C) and low C/I/A impacts reflect script execution in a victim's browser session rather than direct server compromise. No EPSS score was supplied, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no verified public exploit code was provided - the only reference is the Patchstack advisory that sourced the finding. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent, authentication-gated stored XSS. Net: this is a legitimate issue to patch on a normal cadence rather than an emergency; its practical risk depends heavily on how loosely the site provisions low-privilege accounts.

An attacker holding a low-privileged authenticated WordPress account (e.g., contributor/author) saves a panorama item whose field is not sanitized, embedding malicious JavaScript. When an administrator or another user later views the page or admin screen rendering that panorama, the stored script executes in their browser session, enabling session/cookie theft or actions in the victim's context. No verified working exploit code was provided - only the Patchstack advisory reference.