Live › vulnerability › CVE-2026-114429
Go to dashboardThe WPVR WordPress plugin before 9.0.3 does not sanitise or escape some tour hotspot content before storing and displaying it on the front end. A user with Contributor role or higher can store script that runs in the browser of anyone who views the affected tour.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the WPVR WordPress plugin before that have users with Contributor role or above who can edit tour hotspot content. Sites without the plugin, or running or later, are not affected.
9.0.39.0.3No product ranges from the sources yet.
wp plugin get wpvr --field=version9.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.
This page as .md · .json · in your agent: get_signal("CVE-2026-114429")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.