CVE-2026-114429: WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

Q: Which users can exploit this issue?

A user with the WordPress Contributor role or a higher-privileged role can exploit it by adding malicious content to a tour hotspot.

Q: Who is exposed to the stored script?

Any user who views an affected tour in their browser may execute the stored script.

Q: Which plugin versions are affected?

WP VR versions before 9.0.3 are affected. The reported affected range is 8.5.49 through 9.0.2.

Published Oct 24, 2026

Updated

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

Affected Software

1 affected component

WP VR>=8.5.49<=9.0.2

Event History

Oct 24, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

A user with the WordPress Contributor role or a higher-privileged role can exploit it by adding malicious content to a tour hotspot.

Who is exposed to the stored script?

Any user who views an affected tour in their browser may execute the stored script.

Which plugin versions are affected?

WP VR versions before 9.0.3 are affected. The reported affected range is 8.5.49 through 9.0.2.