29 matches found
CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish...
CVE-2026-114741
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...
CVE-2026-114742
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...
WordPress WPVR plugin 8.5.55-9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing vulnerability
Contributor+ Arbitrary Tour Creation and Publishing vulnerability discovered by an7ln in WordPress Plugin WP VR versions 8.5.55-9.1.2...
EUVD-2026-109349
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...
WordPress WPVR plugin 8.3.0-9.0.2 - Contributor+ Arbitrary Tour Update vulnerability
Contributor+ Arbitrary Tour Update vulnerability discovered by Huseyn Huseynov in WordPress Plugin WP VR versions 8.3.0-9.0.2...
EUVD-2026-109347
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish...
CVE-2026-114740
The WPVR WordPress plugin (versions 8.5.55-9.1.2 ) is vulnerable to an authorization bypass issue because it fails to properly validate user capabilities during the tour creation process in its setup wizard . This allows users with the Contributor role or higher to create and publish tour content...
CVE-2026-114742
The WPVR WordPress plugin, in versions 8.3.0 through 9.0.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access or higher to modify, reconfi...
EUVD-2026-109348
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...
WordPress WPVR plugin 9.0.0-9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure vulnerability
Contributor+ Arbitrary Tour Update and Disclosure vulnerability discovered by RIA Labs in WordPress Plugin WP VR versions 9.0.0-9.0.2...
CVE-2026-114740 WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish...
CVE-2026-114740 WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish...
PT-2026-122946
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...
PT-2026-122945
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish...
PT-2026-122947
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...
CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...
WordPress WPVR plugin 8.5.49-9.0.2 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Huseyn Huseynov in WordPress Plugin WP VR versions 8.5.49-9.0.2...
EUVD-2026-109218
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browse...
PT-2026-122509
Name of the Vulnerable Software and Affected Versions WPVR WordPress plugin versions prior to 9.0.3 Description Insufficient sanitization and escaping of tour hotspot content before storage and front-end output allows users with the Contributor role and above to perform Stored Cross-Site Scriptin...