Skip to content
Noroxi

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress

wpvr · plugin

Known security vulnerabilities for WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress. Find out in seconds which version runs on your site with WP Lens.

9 known vulnerabilities

1 critical · 2 exploitable without logging in · latest Oct 26, 2025

Listed on wordpress.org · latest 9.1.4 · last updated Oct 2, 2026 · 10K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-47452login required≤ 8.5.26

    WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability

    Critical 9.9

  • CVE-2023-25708unauthenticated · needs a click≤ 8.2.7

    WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2025-62885login required≤ 8.5.48

    WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2025-24730login required≤ 8.5.14

    WordPress WP VR plugin <= 8.5.14 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2023-40663unauthenticated · needs a click≤ 8.3.4

    WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2024-49293login required≤ 8.5.4

    WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2025-6350contributor+≤ 8.5.32

    WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-49680login required≤ 8.5.5

    WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2025-12005contributor+≤ 8.5.41

    WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory