{
 "id": "WPSEC-2026-2244",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2244/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2244/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2244/index.md",
 "title": "3D viewer – Embed 3D Models <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iOS USDZ Model URL",
 "description": "The 3D Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iOS (USDZ) model URL setting of the 3D Viewer block and Elementor widget in all versions up to, and including, 2.0.0, due to missing URL scheme validation before the value is passed to the model-viewer 'ios-src' attribute, which model-viewer opens as a link for AR Quick Look. This makes it possible for authenticated attackers, with contributor-level access and above, to store a javascript: URL that executes arbitrary script in the browser of a user who starts AR on an affected page.",
 "plugin": {
  "slug": "3d-viewer",
  "name": "3D viewer – Embed 3D Models",
  "full_name": "3D Viewer – Turn Product Pages into Interactive 3D Experiences",
  "wordpress_org": "https://wordpress.org/plugins/3d-viewer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/3d-viewer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/3d-viewer"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.9.0",
    "from_inclusive": true,
    "to": "2.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.9.0 before 2.1.0"
  ]
 },
 "introduced_in": "1.9.0",
 "fixed_in": "2.1.0",
 "remediation": "Update to 2.1.0 or later.",
 "fix_released": "2026-11-02T02:24:55+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:21:16.523057+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2244/",
  "https://plugins.svn.wordpress.org/3d-viewer/tags/2.1.0/",
  "https://wordpress.org/plugins/3d-viewer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/3d-viewer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}