CVE-2026-114429
Received Received - Intake

Stored XSS in WPVR WordPress Plugin

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: WPScan

Description
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-114429
EUVD
EUVD-2026-109218

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown WPVR 8.5.49

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the WPVR WordPress plugin versions 8.5.49 to 9.0.2. It occurs because the plugin does not properly sanitize or escape user input in tour hotspot content before storing and displaying it. Attackers with Contributor role or higher can inject malicious scripts that execute in the browsers of users viewing the affected tour.

Detection Guidance

Check if the WP VR plugin version is between 8.5.49 and 9.0.2. Inspect tour hotspot content for unusual scripts or payloads in the WordPress admin panel or database. Review browser console logs for unexpected script executions when viewing tours.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious scripts in the browsers of anyone viewing the affected tour. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of the user. Users with Contributor role or higher are the primary threat actors.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using the vulnerable plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update the WP VR plugin to version 9.0.3 or later immediately. Remove or sanitize any suspicious hotspot content added by unauthorized users. Restrict Contributor role permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart