CVE-2026-114429

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

View on CVE.org
Published Oct 24, 2026 CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Description
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

Analysis

AI-generated

Technical impact

The WPVR WordPress plugin fails to properly sanitize and escape certain hotspot content before storing it. Users with the Contributor role or higher can insert arbitrary JavaScript into hotspot fields. When a tour containing this content is viewed, the injected script executes in the browser of any visitor, allowing attackers to run arbitrary code in the victim’s browser context. No other impact details are specified in the CVE report.

Affected Systems

WordPress sites running the WPVR plugin versions prior to 9.0.3, including releases 8.5.49 through 9.0.2. No specific CPE or version details are provided beyond the plugin name.

Risk and Exploitability

The vulnerability requires a user to possess a Contributor role or higher to inject the payload. No additional system privileges are needed. Once a tour has been compromised, the stored XSS affects all users who view that tour. The EPSS score is < 1% and the CVSS score is 6.8, indicating moderate severity; the vulnerability is not listed in CISA KEV, but the stored nature and broad exposure make it a high‑risk issue.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WPVR plugin to version 9.0.3 or later to apply the sanitization fix.
  • Recreate or delete any tours that contain hotspot content after upgrading, ensuring malicious payloads are removed.
  • If an upgrade cannot be performed immediately, restrict the Contributor role’s permission to edit hotspot content or require approval before publishing.
  • As a temporary measure, disable hotspot functionality via plugin settings or remove the plugin until a secure version is available.

Generated by OpenCVE AI on October 24, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-79
Type Values Removed Values Added
Description The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.
Title WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
References

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Oct 24, 2026, 2:36 PM
Reserved
Oct 21, 2026, 1:33 PM

View source JSON

Updated
Oct 24, 2026, 2:32 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 6:16 AM
Modified
Oct 26, 2026, 1:50 PM

View source JSON

No data.

Updated
Oct 24, 2026, 4:45 PM

JSON