CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-6529 – WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS
https://notcve.org/view.php?id=CVE-2023-6529
14 Dec 2023 — The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities. El complemento WP VR de WordPress anterior a 8.3.15 no autoriza y CSRF en una función vinculada a admin_init, lo que permite a los usuarios no autenticados degradar el complemento, lo que lleva a XSS reflejado o almacenado, ya que las versiones anteriores ti... • https://wpscan.com/vulnerability/c36314c1-a2c0-4816-93c9-e61f9cf7f27a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37977 – WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-37977
13 Jul 2023 — Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin <= 2.7.16 versions. The WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order_id parameter in versions up to, and including, 2.7.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick ... • https://patchstack.com/database/vulnerability/wpfunnels/wordpress-wpfunnels-plugin-2-7-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1414 – WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update
https://notcve.org/view.php?id=CVE-2023-1414
29 Mar 2023 — The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours The WP VR plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an AJAX action in versions up to, and including, 8.2.9. This makes it possible for subscriber-level attackers to update tours. • https://wpscan.com/vulnerability/d61d4be7-9251-4c62-8fb7-8a456aa6969e • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1413 – WP VR < 8.2.9 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-1413
22 Mar 2023 — The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin The WP VR plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'active_tab', 'scene', and 'hotspot' parameters in versions up to, and including, 8.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated a... • https://wpscan.com/vulnerability/6938fee5-3510-45e6-8112-c9e2b30f6881 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25708 – WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-25708
14 Feb 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions. The WP VR plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.7. This is due to missing or incorrect nonce validation on the 'wpvr_role_management' function. This makes it possible for unauthenticated attackers to change plugin settings, including granting author-level users the ability to create VR tours, via a f... • https://patchstack.com/database/vulnerability/wpvr/wordpress-wp-vr-360-panorama-and-virtual-tour-builder-plugin-8-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •