{"id":"CVE-2026-115956","kind":"vulnerability","aliases":["CVE-2026-115956"],"related":[],"title":"Panorama Viewer WordPress plugin: stored XSS through unsanitized input","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3.","summary":"The bPlugins Panorama Viewer 360 Degree Image and Video Viewer plugin stores user-supplied input without neutralizing it before rendering web pages. An attacker who can submit that input can plant a script that runs in the browsers of visitors or administrators who view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Panorama Viewer plugin in the WordPress admin under Plugins; versions through `1.8.3` are listed as affected.\n- Run `wp plugin get panorama-viewer --field=version` if WP-CLI is available (slug unverified).","fix":"- Update Panorama Viewer – 360 Degree Image + Video Viewer to a version later than `1.8.3`; the sources do not name the fixed version.\n- Until updated, restrict who can add or edit panorama content.","status":"open","published_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","triaged_at":"2026-10-26T11:31:04+00:00","updated_at":"2026-10-26T11:31:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update Panorama Viewer – 360 Degree Image + Video Viewer to a version later than `1.8.3`; the sources do not name the fixed version.\n- Until updated, restrict who can add or edit panorama content.","reach":"internet","title":"Panorama Viewer WordPress plugin: stored XSS through unsanitized input","impact":"medium","summary":"The bPlugins Panorama Viewer 360 Degree Image and Video Viewer plugin stores user-supplied input without neutralizing it before rendering web pages. An attacker who can submit that input can plant a script that runs in the browsers of visitors or administrators who view the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitor or admin browsers on the site","analyst_note":"Confirm the fixed plugin version and the privilege level needed to inject the stored payload from the NVD entry or the plugin changelog.","how_to_check":"- Check the installed version of the Panorama Viewer plugin in the WordPress admin under Plugins; versions through `1.8.3` are listed as affected.\n- Run `wp plugin get panorama-viewer --field=version` if WP-CLI is available (slug unverified).","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the bPlugins Panorama Viewer plugin at version 1.8.3 or earlier, where the plugin stores user input that is later rendered into pages. Sites without the plugin installed can skip it. The sources do not say whether anonymous visitors can inject the input or whether a contributor-level account is needed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":3343,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115956':12A,15A '-2026':11A,14A '1.8.3':110C '360':28B,89C,102C 'administr':66B 'affect':70B,99C 'allow':95C 'attack':48B 'bplugin':25B,86C 'browser':62B 'cross':81C 'cross-sit':80C 'cve':10A,13A 'degre':29B,90C,103C 'generat':79C 'host':19B 'imag':30B,91C,104C 'improp':72C 'input':9A,39B,53B,75C 'issu':98C 'n/a':108C 'neutral':41B,73C 'packag':16B 'page':46B,71B,78C 'panorama':1A,26B,87C,94C,100C 'plant':55B 'plugin':4A,23B,34B 'render':44B 'run':59B 'script':57B,83C 'self':18B 'self-host':17B 'site':82C 'store':5A,35B,96C 'submit':51B 'suppli':38B 'unsanit':8A 'user':37B 'user-suppli':36B 'video':32B,92C,105C 'view':68B 'viewer':2A,27B,33B,88C,93C,101C,106C 'visitor':64B 'vulner':84C 'web':45B,77C 'without':40B 'wordpress':3A,20B,22B 'wordpress-plugin':21B 'xss':6A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the bPlugins Panorama Viewer plugin at version 1.8.3 or earlier, where the plugin stores user input that is later rendered into pages. Sites without the plugin installed can skip it. The sources do not say whether anonymous visitors can inject the input or whether a contributor-level account is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115956","severity":null,"published_at":"2026-10-26T11:16:36+00:00","modified_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","fetched_at":"2026-10-26T11:29:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}