{"id":"CVE-2026-114429","kind":"vulnerability","aliases":["CVE-2026-114429"],"related":[],"title":"WPVR WordPress plugin: stored XSS via tour hotspot content","description":"The WPVR  WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.","summary":"The WPVR WordPress plugin before 9.0.3 does not sanitise or escape some tour hotspot content before storing and displaying it on the front end. A user with Contributor role or higher can store script that runs in the browser of anyone who views the affected tour.","severity":"medium","cvss":null,"epss":0.00208,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvr"],"not_affected_if":["no-wpvr-plugin","plugin-version-9.0.3-or-later"],"how_to_check":"- Check the installed WPVR plugin version in the WordPress admin Plugins screen or with `wp plugin get wpvr --field=version`\n- Review which accounts hold the Contributor role or above","fix":"- Update the WPVR plugin to `9.0.3` or later\n- unknown whether a workaround exists before updating","status":"open","published_at":"2026-10-24T06:16:37+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:50+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WPVR plugin to `9.0.3` or later\n- unknown whether a workaround exists before updating","reach":"internet","title":"WPVR WordPress plugin: stored XSS via tour hotspot content","impact":"medium","summary":"The WPVR WordPress plugin before 9.0.3 does not sanitise or escape some tour hotspot content before storing and displaying it on the front end. A user with Contributor role or higher can store script that runs in the browser of anyone who views the affected tour.","category":"package","nicknames":[],"who_cares":["wordpress","wpvr","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Script runs in visitors' browsers, stealing sessions or altering admin pages.","analyst_note":"Confirm the affected version range and whether a workaround exists; see https://nvd.nist.gov/vuln/detail/CVE-2026-114429 and the plugin's changelog.","how_to_check":"- Check the installed WPVR plugin version in the WordPress admin Plugins screen or with `wp plugin get wpvr --field=version`\n- Review which accounts hold the Contributor role or above","needs_analyst":true,"not_affected_if":["plugin-version-9.0.3-or-later","no-wpvr-plugin"],"who_is_affected":"Sites running the WPVR WordPress plugin before `9.0.3` that have users with Contributor role or above who can edit tour hotspot content. Sites without the plugin, or running `9.0.3` or later, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3323,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114429':12A,15A '-2026':11A,14A '9.0.3':27B,73C 'affect':66B,124C 'allow':98C 'anyon':62B 'attack':113C 'browser':60B,118C 'content':9A,36B,85C 'contributor':49B,102C 'could':97C 'cross':110C 'cross-sit':109C 'cve':10A,13A 'display':40B 'end':45B,95C 'escap':32B,79C 'execut':115C 'front':44B,94C 'higher':52B 'host':19B 'hotspot':8A,35B,84C 'output':90C 'packag':16B 'perform':107C 'plugin':3A,25B,71C 'proper':76C 'role':50B,103C 'run':57B 'sanitis':30B,77C 'script':55B,112C 'self':18B 'self-host':17B 'site':111C 'store':4A,38B,54B,87C,108C 'tour':7A,34B,67B,83C,125C 'user':47B,99C,121C 'via':6A 'view':64B,122C 'wordpress':2A,20B,24B,70C 'wpvr':1A,21B,23B,69C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPVR WordPress plugin before `9.0.3` that have users with Contributor role or above who can edit tour hotspot content. Sites without the plugin, or running `9.0.3` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114429","severity":null,"published_at":"2026-10-24T06:16:37+00:00","modified_at":"2026-10-24T06:16:37+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114429","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114429","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}