# 3D viewer – Embed 3D Models <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iOS USDZ Model URL

- **ID:** WPSEC-2026-2244
- **Plugin:** 3D Viewer – Turn Product Pages into Interactive 3D Experiences (`3d-viewer`), https://wordpress.org/plugins/3d-viewer/
- **Affected versions:** from 1.9.0 before 2.1.0
- **Fixed in:** 2.1.0 (Update to 2.1.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/3d-viewer
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2244/

## Description

The 3D Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iOS (USDZ) model URL setting of the 3D Viewer block and Elementor widget in all versions up to, and including, 2.0.0, due to missing URL scheme validation before the value is passed to the model-viewer 'ios-src' attribute, which model-viewer opens as a link for AR Quick Look. This makes it possible for authenticated attackers, with contributor-level access and above, to store a javascript: URL that executes arbitrary script in the browser of a user who starts AR on an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2244/
- https://plugins.svn.wordpress.org/3d-viewer/tags/2.1.0/
- https://wordpress.org/plugins/3d-viewer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2244/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.