Approved changes feed: RSS · Atom
cpe:2.3:a:rextheme:wp_vr:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Rextheme (fb4175f3-ed37-5cdd-87b9-706aaba4d37d) |
|---|---|
| Product | Wp Vr (bd3b3403-7dae-5360-b175-1ab300d4cc14) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-6350 |
vulnerable | 2026-06-08 07:43:14.898390 |
WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
MEDIUM (6.4)
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-06-28T03:21:59.671Z
Updated: 2026-04-08T17:24:22.666Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-49293 |
vulnerable | 2026-06-08 06:50:13.381484 |
WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability
MEDIUM (4.3)
Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.4.
Published: 2024-10-21T11:12:20.813Z
Updated: 2026-05-11T21:14:19.799Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6529 |
vulnerable | 2026-06-08 06:19:47.553868 |
WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
Published: 2024-01-08T19:00:26.949Z
Updated: 2025-06-18T16:50:52.089Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40663 |
vulnerable | 2026-06-08 06:11:04.172857 |
WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)
HIGH (7.1)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.
Published: 2023-09-27T05:40:13.695Z
Updated: 2026-04-28T16:08:37.064Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25708 |
vulnerable | 2026-06-08 05:56:09.676708 |
WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.
Published: 2023-03-15T10:30:25.030Z
Updated: 2026-04-28T16:08:09.924Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1414 |
vulnerable | 2026-06-08 05:52:35.796664 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1413 |
vulnerable | 2026-06-08 05:52:35.796237 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0174 |
vulnerable | 2026-06-08 05:52:04.422310 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.