Stored Cross-Site Scripting in WPVR WordPress Plugin
CVE-2026-114429
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-114429?
The WPVR WordPress plugin prior to version 9.0.3 fails to adequately sanitize and escape certain tour hotspot contents before storing and rendering them on the front end. This oversight enables users with the Contributor role and above to execute Stored Cross-Site Scripting (XSS) attacks, potentially compromising the security of any visitors interacting with the affected tours.
Affected Version(s)
WPVR 8.5.49 < 9.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.