Vulnerabilities / 3D viewer – Embed 3D Models / WPSEC-2026-2244
3D viewer – Embed 3D Models <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iOS USDZ Model URL
Medium 5.4
CWE-79Fixed in 2.1.0
- ID
- WPSEC-2026-2244
- Plugin
- 3D Viewer – Turn Product Pages into Interactive 3D Experiences (3d-viewer)
- Affected
- from 1.9.0 before 2.1.0
- Remediation
- Update to 2.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- 3D viewer – Embed 3D Models on WPSec AttackSurface
- Fix released
- Published
Description
The 3D Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iOS (USDZ) model URL setting of the 3D Viewer block and Elementor widget in all versions up to, and including, 2.0.0, due to missing URL scheme validation before the value is passed to the model-viewer 'ios-src' attribute, which model-viewer opens as a link for AR Quick Look. This makes it possible for authenticated attackers, with contributor-level access and above, to store a javascript: URL that executes arbitrary script in the browser of a user who starts AR on an affected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2244/
- https://plugins.svn.wordpress.org/3d-viewer/tags/2.1.0/
- https://wordpress.org/plugins/3d-viewer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS