← WordPress Vulnerabilities
WordPress security by component

WP VR

WP VR is a WordPress component with 8 published CVE records in this archive. The latest tracked vulnerability was published Oct 27, 2025; the highest CVE/CNA score is 9.9.

Plugin slug: wpvr

CVE-2025-62885: WP VR: Cross-site scripting

WP VR is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

PublishedOct 27, 2025
Safe version guidanceSee mitigation notes
Safe version
Oct 27, 2025 CVE-2025-62885
WP VR: Cross-site scripting
WP VR is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVDPending
Oct 25, 2025 CVE-2025-12005
WP VR – 360 Panorama and Free Virtual Tour Builder For: A security weakness
WP VR – 360 Panorama and Free Virtual Tour Builder For is affected by a security weakness. Exploitation requires at least contributor-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Jun 28, 2025 CVE-2025-6350
WP VR – 360 Panorama and Free Virtual Tour Builder For: Cross-site scripting
WP VR – 360 Panorama and Free Virtual Tour Builder For is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
Jun 17, 2025 CVE-2025-47452
WP VR: Dangerous file upload
WP VR is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
See mitigation notes
CVE9.9
NVDPending
Jan 24, 2025 CVE-2025-24730
WP VR: Cross-site scripting
WP VR is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVDPending
Nov 19, 2024 CVE-2024-49680
WP VR: A security weakness
WP VR is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Sep 27, 2023 CVE-2023-40663
Wpvr: Cross-site scripting
Wpvr is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE7.1
NVD6.1
Mar 15, 2023 CVE-2023-25708
Wpvr: Cross-site request forgery
Wpvr is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVD8.8