# WP VR <= 9.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via Scene Image URL

- **ID:** WPSEC-2026-0927
- **Plugin:** WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress (`wpvr`), https://wordpress.org/plugins/wpvr/
- **Affected versions:** all versions before 9.3.0
- **Fixed in:** 9.3.0 (Update to 9.3.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpvr
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0927/

## Description

The WPVR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the scene image URL of panorama tours in all versions up to, and including, 9.2.0, due to insufficient input sanitization and URL scheme validation. The URL is saved unchanged by both the classic tour editor's save handler and the REST tour update endpoint. When the image cannot be loaded, the bundled Pannellum viewer shows the stored URL as a clickable link in its error message, so a javascript: URL runs when the link is clicked. This makes it possible for authenticated attackers with Author-level access and above, on sites where tour editing has been granted to authors, to inject arbitrary web scripts that execute when a user views the tour and clicks the link in the error message.

## References

- https://wpsec.com/vuln/WPSEC-2026-0927/
- https://plugins.svn.wordpress.org/wpvr/tags/9.3.0/
- https://wordpress.org/plugins/wpvr/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0927/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.