WPVR vulnerabilities
CVEs whose affected-version data names the WPVR package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-114429NoneWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform S…
▾ Sunlitvia CVEORG
CVE-2026-104386Medium· 6.5Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
▾ SunlitWPFunnels Team · wpvrEPSS 0.15%via NVD