CVE-2023-6529: WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admininit, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6529?
CVE-2023-6529 is classified as a critical vulnerability due to its potential for unauthenticated users to exploit the plugin.
How do I fix CVE-2023-6529?
To fix CVE-2023-6529, update the WP VR WordPress plugin to version 8.3.15 or later.
What kind of attacks can CVE-2023-6529 facilitate?
CVE-2023-6529 can facilitate reflected or stored XSS attacks by allowing unauthenticated users to downgrade the plugin.
Which versions of WP VR are affected by CVE-2023-6529?
All versions of the WP VR WordPress plugin prior to 8.3.15 are affected by CVE-2023-6529.
Who is at risk due to CVE-2023-6529?
Websites using versions of the WP VR plugin before 8.3.15 are at risk from CVE-2023-6529 if they allow unauthenticated access to the admin area.