PT-2024-14996 · WordPress · Wp Vr

Name of the Vulnerable Software and Affected Versions: WP VR WordPress plugin versions prior to 8.3.15 Description: The issue concerns a lack of authorization and CSRF protection in a function hooked to admin init, allowing unauthenticated users to downgrade the plugin. This can lead to Reflected...

CVE-2023-40663

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rextheme WP VR plugin = 8.3.4 versions...

CVE-2023-40663

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rextheme WP VR plugin = 8.3.4 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Rextheme WP VR plugin = 8.3.4 versions...

CVE-2023-40663

CVE-2023-40663 affects the WordPress WP VR plugin, versions

WordPress WP VR Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software WP VR Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer WPFunnels Team PSID de1111c82f8a Credits Rafie Muhammad Patchstack Required privilege...

CVE-2023-1414

The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours...

CVE-2023-1414

CVE-2023-1414 affects WP VR WordPress plugin prior to 8.3.0. Patchstack details indicate a Broken Access Control vulnerability requiring Subscriber privileges, allowing an authenticated user to perform arbitrary tour updates. The issue is fixed in version 8.3.0; remediation is to upgrade to 8.3.0...

CVE-2023-1414 WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update

The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours...

CVE-2023-1413

CVE-2023-1413 concerns the WP VR WordPress plugin prior to version 8.2.9. The vulnerability is a reflected Cross-Site Scripting (XSS) caused by insufficient sanitisation/escaping of parameters before echoing them on output. This could be exploited against high-privilege users such as admins. Acco...

CVE-2023-1413 WP VR < 8.2.9 - Reflected XSS

The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress WP VR Plugin < 8.2.9 is vulnerable to Cross Site Scripting (XSS)

Software WP VR Type Plugin Vulnerable versions 8.2.9 Fixed in 8.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1413 Patch priority High CVSS severity High 7.1 Developer WPFunnels Team PSID f109d593f865 Credits Erwan LR WPScan Required privilege...

CVE-2023-25708

Cross-Site Request Forgery CSRF vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin = 8.2.7 versions...

CVE-2023-25708

Cross-Site Request Forgery CSRF vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin = 8.2.7 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin = 8.2.7 versions...

CVE-2023-25708

CVE-2023-25708 is a Cross-Site Request Forgery (CSRF) vulnerability in the Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin, affecting WordPress sites running versions

WordPress Plugin Rextheme WP VR – 360 Panorama and Virtual Tour Builde 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. WordPress Plugin Rextheme ...

CVE-2023-0174

The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0174

The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0174

The WP VR WordPress plugin is affected: older releases before 8.2.7 do not validate or escape some shortcode attributes when rendering, enabling Stored XSS on pages/posts containing the shortcode for users with the Contributor role or higher. Remediation: upgrade to version 8.2.7 (fixed).