The Panorama Viewer – 360 Degree Image + Video Viewer plugin implements improper neutralization of input during web page generation, enabling stored cross‑site scripting. An attacker can inject malicious scripts that are later served to any user who views the affected page, creating the potential for session hijacking, defacement or credential theft.

This vulnerability affects all versions of the Panorama Viewer plugin up to (and including) 1.8.3, with the affected version range specified as n/a through 1.8.3.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not yet widely exploited. The attack vector is inferred to be a stored XSS, where malicious content is input into the plugin’s storage and subsequently rendered to the page, enabling unauthenticated or lower‑privilege users to inject and trigger the payload.