Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wpvr:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wpvr (ad30bb77-bd9b-5606-9bd4-3820af74b9ac) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114740 |
vulnerable | 2026-11-03 10:15:53.882191 |
WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
Published: 2026-10-25T06:00:21.122Z
Updated: 2026-10-26T10:13:37.109Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114429 |
vulnerable | 2026-11-03 10:15:53.555559 |
WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.
Published: 2026-10-24T06:00:20.190Z
Updated: 2026-10-24T14:36:53.345Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114741 |
vulnerable | 2026-11-03 10:15:53.536533 |
WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
Published: 2026-10-25T06:00:21.321Z
Updated: 2026-10-26T10:13:36.969Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114742 |
vulnerable | 2026-11-03 10:15:52.984069 |
WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Published: 2026-10-25T06:00:21.497Z
Updated: 2026-10-26T10:13:36.824Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.