Wpvr
Monthly
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Stored cross-site scripting in the WPVR WordPress plugin before 9.0.3 lets authenticated users with the Contributor role or higher plant script inside tour hotspot content, which then runs in the browser of anyone who later views the affected tour. The vulnerable code neither sanitises nor escapes that hotspot content on storage or on front-end output (CWE-79), so the payload persists in the tour and fires on view rather than at injection time. Exploitation requires a valid low-privilege account and use of the tour-hotspot feature, and impact is confined to the browsers of tour viewers rather than the WordPress server itself; a public PoC reference exists but is not verified as working exploit code, EPSS is low at 0.21% (10th percentile), and the item is not flagged for confirmed active exploitation (CISA KEV), consistent with a managed, this-month priority.
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Stored cross-site scripting in the WPVR WordPress plugin before 9.0.3 lets authenticated users with the Contributor role or higher plant script inside tour hotspot content, which then runs in the browser of anyone who later views the affected tour. The vulnerable code neither sanitises nor escapes that hotspot content on storage or on front-end output (CWE-79), so the payload persists in the tour and fires on view rather than at injection time. Exploitation requires a valid low-privilege account and use of the tour-hotspot feature, and impact is confined to the browsers of tour viewers rather than the WordPress server itself; a public PoC reference exists but is not verified as working exploit code, EPSS is low at 0.21% (10th percentile), and the item is not flagged for confirmed active exploitation (CISA KEV), consistent with a managed, this-month priority.