WPVR EUVD-2026-109218

Exploitation requires an authenticated account with the Contributor role or higher on a site running the WPVR plugin before 9.0.3, plus the ability to create or edit a tour and add hotspot content (the specific feature whose content is not sanitised/escaped before storage and front-end output). Execution is not immediate: a victim must subsequently view the affected tour on the front end (UI:R), at which point the stored script runs in that viewer's browser. Limiting factors: no anonymous/unauthenticated path (a valid low-privilege account is needed), dependence on the tour-hotspot feature being used, and reliance on a victim actually loading the poisoned tour; impact is confined to the browser context of users who view it rather than the WordPress server itself.

This is a moderate-severity, authenticated Stored XSS (CWE-79) in the WPVR WordPress plugin, and the combined signals point to a managed rather than emergency priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, base 6.8) is internally inconsistent with the description: it rates privileges as high (PR:H) while the description states the attacker only needs the Contributor role, which is a low-privilege authenticated role, and it rates confidentiality, integrity and availability as High (C:H/I:H/A:H) and scope Unchanged (S:U), which overstates a reflected-in-browser XSS whose real effect is a cross-context (scope-changing) impact of limited magnitude - treat the vendor base score as an upper bound and verify with WPScan/vendor. The EPSS score is low (0.21%, 10th percentile), there is no CISA KEV listing, and the referenced exploit is a WPScan advisory link that is not verified as working exploit code, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', consistent with a patch-this-cycle item rather than an act-now emergency. Net: a real but prioritizable issue - it requires an authenticated contributor account and a victim viewing the tour, which bounds real-world risk well below the 6.8 CVSS impression.

An attacker who already holds a Contributor (or higher) account on a WPVR-enabled site - for example via self-registration or a compromised low-privilege account - injects a malicious script into the unsanitised hotspot content of a 360° tour. When any user, including an administrator, later views that tour on the front end, the stored script executes in their browser session. A public PoC reference exists (WPScan advisory); it is not verified as working exploit code.