Improper neutralization of user input in the RexTheme WP VR WordPress plugin results in a DOM‑based Cross‑Site Scripting flaw. The vulnerability is classified as CWE‑79 and allows an attacker to inject malicious JavaScript that runs in the context of any site visitor, including administrators. Successful exploitation can lead to defacement, phishing, session hijacking, or theft of sensitive data held on the site.

The flaw affects the WP VR plugin by RexTheme for WordPress versions from the earliest release through 8.5.48. The safe state is achieved by installing version 8.5.49 or later, which contains the remediation for the input sanitization issue.

The CVSS score of 6.5 indicates a moderate severity, while an EPSS score of less than 1% suggests that exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a crafted URL or malicious content that a visitor or administrator loads within the plugin’s interface; no privileged access is required to trigger the flaw, and the impact can affect all users who view the vulnerable page.