Medium severity · published Oct 24, 2026
CVE-2026-114429
WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
New
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WPVR ·
8.5.49 before 9.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114429
wpscan.com
https://wpscan.com/vulnerability/30409336-b8ed-49f7-bc40-96c21f494155/
More from WPVR
4.9
CVE-2026-114740
WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
3.8
CVE-2026-114741
WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
2.7
CVE-2026-114742
WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR