Live › vulnerability › CVE-2026-115956
Go to dashboardThe bPlugins Panorama Viewer 360 Degree Image and Video Viewer plugin stores user-supplied input without neutralizing it before rendering web pages. An attacker who can submit that input can plant a script that runs in the browsers of visitors or administrators who view the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Sites running the bPlugins Panorama Viewer plugin at version 1.8.3 or earlier, where the plugin stores user input that is later rendered into pages. Sites without the plugin installed can skip it. The sources do not say whether anonymous visitors can inject the input or whether a contributor-level account is needed.
No product ranges from the sources yet.
1.8.3 are listed as affected.wp plugin get panorama-viewer --field=version if WP-CLI is available (slug unverified).1.8.3; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-115956")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.