Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-114742 (GCVE-0-2026-114742)

Vulnerability from nvd – Published: 2026-10-25 06:00 – Updated: 2026-10-25 06:00

Title

WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

Summary

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

Severity

No CVSS data available.

CWE

CWE-639 Authorization Bypass Through User-Controlled Key

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/201b0ca5-366d-44…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 8.3.0 , < 9.0.3 (semver)

Credits

Huseyn Huseynov WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.0.3",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Huseyn Huseynov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T06:00:21.497Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114742",
    "datePublished": "2026-10-25T06:00:21.497Z",
    "dateReserved": "2026-10-22T03:35:15.033Z",
    "dateUpdated": "2026-10-25T06:00:21.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114741 (GCVE-0-2026-114741)

Vulnerability from nvd – Published: 2026-10-25 06:00 – Updated: 2026-10-25 06:00

Title

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

Summary

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

Severity

No CVSS data available.

CWE

CWE-639 Authorization Bypass Through User-Controlled Key

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/bfa704b5-b934-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 9.0.0 , < 9.0.3 (semver)

Credits

RIA Labs WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.0.3",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RIA Labs"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T06:00:21.321Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bfa704b5-b934-4615-aa75-d50b28baedf7/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114741",
    "datePublished": "2026-10-25T06:00:21.321Z",
    "dateReserved": "2026-10-22T03:34:23.839Z",
    "dateUpdated": "2026-10-25T06:00:21.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114740 (GCVE-0-2026-114740)

Vulnerability from nvd – Published: 2026-10-25 06:00 – Updated: 2026-10-25 06:00

Title

WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

Summary

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

Severity

No CVSS data available.

CWE

CWE-862 Missing Authorization

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/ac47bef6-b870-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 8.5.55 , < 9.1.3 (semver)

Credits

an7ln WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.1.3",
              "status": "affected",
              "version": "8.5.55",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "an7ln"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T06:00:21.122Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/ac47bef6-b870-49ae-b9ad-ace83687280d/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114740",
    "datePublished": "2026-10-25T06:00:21.122Z",
    "dateReserved": "2026-10-22T03:32:37.431Z",
    "dateUpdated": "2026-10-25T06:00:21.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114429 (GCVE-0-2026-114429)

Vulnerability from nvd – Published: 2026-10-24 06:00 – Updated: 2026-10-24 14:36

Title

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

Summary

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-24 14:32 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/30409336-b8ed-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 8.5.49 , < 9.0.3 (semver)

Credits

Huseyn Huseynov WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-114429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-24T14:32:16.554507Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-24T14:36:53.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.0.3",
              "status": "affected",
              "version": "8.5.49",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Huseyn Huseynov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T06:00:20.190Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/30409336-b8ed-49f7-bc40-96c21f494155/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114429",
    "datePublished": "2026-10-24T06:00:20.190Z",
    "dateReserved": "2026-10-21T13:33:36.381Z",
    "dateUpdated": "2026-10-24T14:36:53.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114742 (GCVE-0-2026-114742)

Vulnerability from cvelistv5 – Published: 2026-10-25 06:00 – Updated: 2026-10-25 06:00

Title

WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

Summary

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

Severity

No CVSS data available.

CWE

CWE-639 Authorization Bypass Through User-Controlled Key

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/201b0ca5-366d-44…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 8.3.0 , < 9.0.3 (semver)

Credits

Huseyn Huseynov WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.0.3",
              "status": "affected",
              "version": "8.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Huseyn Huseynov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T06:00:21.497Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/201b0ca5-366d-446e-a92f-6962cd200bd7/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114742",
    "datePublished": "2026-10-25T06:00:21.497Z",
    "dateReserved": "2026-10-22T03:35:15.033Z",
    "dateUpdated": "2026-10-25T06:00:21.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114741 (GCVE-0-2026-114741)

Vulnerability from cvelistv5 – Published: 2026-10-25 06:00 – Updated: 2026-10-25 06:00

Title

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

Summary

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

Severity

No CVSS data available.

CWE

CWE-639 Authorization Bypass Through User-Controlled Key

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/bfa704b5-b934-46…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 9.0.0 , < 9.0.3 (semver)

Credits

RIA Labs WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.0.3",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RIA Labs"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T06:00:21.321Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bfa704b5-b934-4615-aa75-d50b28baedf7/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114741",
    "datePublished": "2026-10-25T06:00:21.321Z",
    "dateReserved": "2026-10-22T03:34:23.839Z",
    "dateUpdated": "2026-10-25T06:00:21.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114740 (GCVE-0-2026-114740)

Vulnerability from cvelistv5 – Published: 2026-10-25 06:00 – Updated: 2026-10-25 06:00

Title

WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

Summary

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

Severity

No CVSS data available.

CWE

CWE-862 Missing Authorization

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/ac47bef6-b870-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 8.5.55 , < 9.1.3 (semver)

Credits

an7ln WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.1.3",
              "status": "affected",
              "version": "8.5.55",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "an7ln"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T06:00:21.122Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/ac47bef6-b870-49ae-b9ad-ace83687280d/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114740",
    "datePublished": "2026-10-25T06:00:21.122Z",
    "dateReserved": "2026-10-22T03:32:37.431Z",
    "dateUpdated": "2026-10-25T06:00:21.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114429 (GCVE-0-2026-114429)

Vulnerability from cvelistv5 – Published: 2026-10-24 06:00 – Updated: 2026-10-24 14:36

Title

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

Summary

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-24 14:32 UTC

CWE

CWE-79 Cross-Site Scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

WPScan CNA under the mitre root

CNA scorecard E 44/100 over 1841 records in the last 180 days details

References

1 reference

URL	Tags
https://wpscan.com/vulnerability/30409336-b8ed-49…	exploitvdb-entrytechnical-description

Impacted products

1 product

Vendor	Product	Version
Unknown	WPVR	Affected: 8.5.49 , < 9.0.3 (semver)

Credits

Huseyn Huseynov WPScan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-114429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-24T14:32:16.554507Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-24T14:36:53.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPVR",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "9.0.3",
              "status": "affected",
              "version": "8.5.49",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Huseyn Huseynov"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPVR  WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T06:00:20.190Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/30409336-b8ed-49f7-bc40-96c21f494155/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-114429",
    "datePublished": "2026-10-24T06:00:20.190Z",
    "dateReserved": "2026-10-21T13:33:36.381Z",
    "dateUpdated": "2026-10-24T14:36:53.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

8 vulnerabilities found for WPVR by Unknown

CVE-2026-114742 (GCVE-0-2026-114742)

CVE-2026-114741 (GCVE-0-2026-114741)

CVE-2026-114740 (GCVE-0-2026-114740)

CVE-2026-114429 (GCVE-0-2026-114429)

CVE-2026-114742 (GCVE-0-2026-114742)

CVE-2026-114741 (GCVE-0-2026-114741)

CVE-2026-114740 (GCVE-0-2026-114740)

CVE-2026-114429 (GCVE-0-2026-114429)