CVE-2026-114429

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

Affected

WPVR

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.31% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-10-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/30409336-b8ed-49f7-bc40-96c21f494155/find archive

CVE references

• https://wpscan.com/vulnerability/30409336-b8ed-49f7-bc40-96c21f494155REFERENCE

References

• CVE Record
• NVD entry