The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin contains a stored cross‑site scripting flaw that is triggered by the hotspot‑hover parameter. Because the input is not sanitized or escaped, an authenticated contributor or higher can store JavaScript that will run in the browser of any visitor to pages that include the hotspot. This allows attackers to steal session cookies, deface content, or redirect users, but does not provide direct server‑side code execution. The weakness is classified as CWE‑79, representing an injection of client‑side code.

All installations of the rextheme WP VR plugin running WordPress up to and including version 8.5.32 are vulnerable. Any website that allows contributors or administrators to edit hotspot data is affected. A version newer than 8.5.32 does not contain this flaw.

The vulnerability has a CVSS score of 6.4, indicating moderate severity for client‑side impact. The EPSS score is below 1 %, suggesting a low probability of exploitation on its own, and it is not listed in the CISA KEV catalog. Because the attack requires authenticated Contributor‑level access, the attack vector is limited to users who can modify hotspot data; successful exploitation would affect all users who view the edited pages. While it does not allow remote code execution, the ability to run arbitrary scripts in visitors’ browsers remains a significant threat