WordPress VR Calendar <=2.3.2 - Remote Code Execution

WordPress VR Calendar plugin through 2.3.2 is susceptible to remote code execution. The plugin allows any user to execute arbitrary PHP functions on the site. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without...

CVE-2026-114741 WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...

CVE-2026-114742 WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...

CVE-2026-114741 WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...

CVE-2026-114741

The WPVR WordPress plugin versions 9.0.0 through 9.0.2 is vulnerable to an Insecure Direct Object Reference (IDOR) issue. The plugin fails to perform adequate object-level authorization checks when handling requests to read or update virtual tours. This allows users with contributor-level access ...

CVE-2026-114742 WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...

CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...

CVE-2026-114429

The WPVR WordPress plugin versions 8.5.49 through 9.0.2 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain tour hotspot content before storage and front-end output. This allows users with Contributor privileges or higher to ...

CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...

GRAML: Graph-Grounded Reasoning and Multi-Task Learning for LLM-Based Software Vulnerability Detection

Large Language Models LLMs have been widely applied to software vulnerability detection. However, their performance is often limited by insufficient use of control-flow and data-flow information. In this paper, we propose GRAML, a framework that combines graph evidence, vulnerability description...

CVE-2026-104386

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

EUVD-2026-92304

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

CVE-2026-104386

The WP VR (wpvr) plugin for WordPress, versions n/a through 9.1.3 , is affected by a Broken Access Control vulnerability (CWE-862 ). The flaw allows for exploiting incorrectly configured access control security levels due to missing authorization. The impact includes potential changes to confiden...

CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Zac Lou in WordPress Plugin WP VR versions = 9.1.3...

PT-2026-104761

Name of the Vulnerable Software and Affected Versions WP VR versions prior to 9.1.3 Description Missing authorization allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version 9.1.3 or later...

CVE-2026-104386: Missing Authorization

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

CVE-2026-72307

A flaw was found in the Linux kernel's mlxsw driver. When the mlxswspvrslpmtreereplace function encounters an error during Virtual Router VR replacement operations, its rollback mechanism fails to correctly release resources. This leads to a reference count leak, where system resources are not...

CVE-2026-72307

CVE-2026-72307 describes a Linux kernel issue in the mlxsw path where, after replacing VRs, the error rollback loop failed to update the vr pointer, causing a refcount leak of new_tree if replacements were partially completed. The root cause: the loop variable could point at the wrong VR, causing...