WP VR <= 9.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via Scene Image URL
- ID
- WPSEC-2026-0927
- Plugin
- WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress (wpvr)
- Affected
- all versions before 9.3.0
- Remediation
- Update to 9.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- WP VR on WPSec AttackSurface
- Fix released
- Published
Description
The WPVR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the scene image URL of panorama tours in all versions up to, and including, 9.2.0, due to insufficient input sanitization and URL scheme validation. The URL is saved unchanged by both the classic tour editor's save handler and the REST tour update endpoint. When the image cannot be loaded, the bundled Pannellum viewer shows the stored URL as a clickable link in its error message, so a javascript: URL runs when the link is clicked. This makes it possible for authenticated attackers with Author-level access and above, on sites where tour editing has been granted to authors, to inject arbitrary web scripts that execute when a user views the tour and clicks the link in the error message.
References
- https://wpsec.com/vuln/WPSEC-2026-0927/
- https://plugins.svn.wordpress.org/wpvr/tags/9.3.0/
- https://wordpress.org/plugins/wpvr/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS