---
id: "CVE-2026-114429"
kind: "vulnerability"
aliases: ["CVE-2026-114429"]
title: "WPVR WordPress plugin: stored XSS via tour hotspot content"
severity: "medium"
cvss: null
epss: 0.00208
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpvr"]
not_affected_if: ["no-wpvr-plugin", "plugin-version-9.0.3-or-later"]
published_at: "2026-10-24T06:16:37+00:00"
first_seen_at: "2026-10-24T06:47:03+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114429", "first_seen_at": "2026-10-24T06:47:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114429", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# WPVR WordPress plugin: stored XSS via tour hotspot content

The WPVR WordPress plugin before 9.0.3 does not sanitise or escape some tour hotspot content before storing and displaying it on the front end. A user with Contributor role or higher can store script that runs in the browser of anyone who views the affected tour.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPVR plugin version in the WordPress admin Plugins screen or with `wp plugin get wpvr --field=version`
- Review which accounts hold the Contributor role or above

## Fix

- Update the WPVR plugin to `9.0.3` or later
- unknown whether a workaround exists before updating

## Timeline

- 2026-10-24T06:47:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114429
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114429

## From the sources

The WPVR  WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_