CVE-2026-115956: WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Panorama Viewer – 360 Degree Image + Video Viewerto a version that resolves this vulnerability.Fixed in 1.8.4
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and user interaction (UI:R). It is remotely reachable over the network (AV:N) and has low attack complexity (AC:L).
Which plugin versions are affected?
The issue affects bPlugins Panorama Viewer – 360 Degree Image + Video Viewer versions through 1.8.3. The provided data does not identify a fixed version.
What is the impact if exploitation succeeds?
This is a stored XSS issue. The supplied severity vector rates confidentiality, integrity, and availability impact as low, with scope changed (S:C).
Is there a mitigation if a patch is not available?
The provided data does not list a fixed release or a specific workaround. Restricting low-privileged users' ability to submit or modify plugin content can reduce the opportunity for exploitation.