Stored Cross-Site Scripting Vulnerability in Ogulo – 360° Tour for WordPress

CVE-2025-9131

What is CVE-2025-9131?

The Ogulo – 360° Tour plugin for WordPress is prone to Stored Cross-Site Scripting through the 'slug' parameter due to inadequate input sanitization and output escaping. This vulnerability allows attackers with Contributor-level access or higher to inject malicious web scripts into pages, which will execute in the context of users who visit those pages, potentially compromising sensitive information and user sessions.

References