WP VR

WPVR lacks object-level ownership checks when updating virtual tours. A Contributor or higher can direct an update at another user’s tour and modify, reconfigure and publish it without the required authority over that object. The update route, tour-ID parameter and exact editable fields are not disclosed in the export. Published affected versions: 8.3.0 to < 9.0.3.

WPVR does not perform object-level authorization when reading and updating virtual tours. A Contributor or higher can select a tour belonging to another user and read or modify it. The affected routes, object-ID parameters and scope of returned fields are not disclosed in the export; access to unrelated WordPress content is not established. Published affected versions: 9.0.0 to < 9.0.3.

WPVR incorrectly checks user capabilities in its tour-creation setup wizard. A Contributor or higher can use that path to create and publish tour content and set arbitrary post metadata that the caller would not otherwise be allowed to create or publish. The wizard endpoint, metadata parameter and any specific privilege-escalation metadata key are not disclosed in the export; administrator account takeover is not established. Published affected versions: 8.5.55 to < 9.1.3.

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 8.5.49 to before 9.0.3. The source narrative identifies Contributor-level access, while the newly supplied CVSS vector specifies high privileges (PR:H); this discrepancy is unresolved, so the disclosed Contributor role is retained.

The supplied CVSS vector requires a low-privilege authenticated account; the minimum WordPress role is not disclosed. A caller can reach a protected operation without the intended permission check. The vector indicates limited disclosure of protected information, unauthorized changes, disruption of availability. Victim interaction is required by the vector, but the export does not explain that prerequisite. The protected resource and exact unauthorized operation are undisclosed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 9.1.3. The authoritative export identifies 9.1.4 as fixed for this CVE.

WP VR is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP VR – 360 Panorama and Free Virtual Tour Builder For is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP VR – 360 Panorama and Free Virtual Tour Builder For is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP VR is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

WP VR is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP VR is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Wpvr is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Wpvr is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.