Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (9.3.1). As of 2026-11-04. 14 issues are on record for older versions; version 9.1.4 or newer fixes all of them that state a fix. Keep WPVR on the latest version (9.3.1) and remove it if you do not use it.

Which versions of WPVR are vulnerable?

Known issues on record (newest first): Missing authorization check (8.5.55 up to (not including) 9.1.3, fixed in 9.1.3); Missing authorization check (9.0.0 up to (not including) 9.0.3, fixed in 9.0.3); Missing authorization check (8.3.0 up to (not including) 9.0.3, fixed in 9.0.3); Stored cross-site scripting (XSS) (8.5.49 up to (not including) 9.0.3, fixed in 9.0.3); Missing authorization check (9.1.3 and older, fixed in 9.1.4); Cross-site scripting (XSS) (8.5.48 and older, fixed in 8.5.49). The full list with sources is on this page.

What is the latest version of WPVR?

9.3.1, according to wordpress.org (last updated 2026-10-16). It has 10,000+ active installs.

What should I do if my WPVR is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update wpvr). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · wpvr · data as of 2026-11-04

Is WPVR safe? Known vulnerabilities and latest version

Latest version: 9.3.1
Last updated: 2026-10-16
Active installs: 10,000+
Known issues on record: 14
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 7.0.0+

Create stunning 360 virtual tours to impress visitors and get more clients using WPVR - an easy virtual tour creator. — by RexTheme

What to do

Update to the latest version (9.3.1). Anything older than 9.1.4 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get wpvr --field=version shows what you run; wp plugin update wpvr updates it.

Check your version

Known vulnerabilities

14 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 4.9 CVE-2026-114740 · published 2026-10-25

Missing authorization check in WPVR (8.5.55 up to (not including) 9.1.3)

Affected: 8.5.55 up to (not including) 9.1.3
Fixed in: 9.1.3
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

NVD CVE-2026-114740 WPScan advisory

low 3.8 CVE-2026-114741 · published 2026-10-25

Missing authorization check in WPVR (9.0.0 up to (not including) 9.0.3)

Affected: 9.0.0 up to (not including) 9.0.3
Fixed in: 9.0.3
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.

NVD CVE-2026-114741 WPScan advisory

low 2.7 CVE-2026-114742 · published 2026-10-25

Missing authorization check in WPVR (8.3.0 up to (not including) 9.0.3)

Affected: 8.3.0 up to (not including) 9.0.3
Fixed in: 9.0.3
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.

NVD CVE-2026-114742 WPScan advisory

medium 6.8 CVE-2026-114429 · published 2026-10-24

Stored cross-site scripting (XSS) in WPVR (8.5.49 up to (not including) 9.0.3)

Affected: 8.5.49 up to (not including) 9.0.3
Fixed in: 9.0.3
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

NVD CVE-2026-114429 WPScan advisory

medium 6.5 CVE-2026-104386 · published 2026-10-05

Missing authorization check in WPVR (9.1.3 and older)

Affected: 9.1.3 and older
Fixed in: 9.1.4
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.

NVD CVE-2026-104386 Patchstack advisory

medium 6.5 CVE-2025-62885 · published 2025-10-27

Cross-site scripting (XSS) in WPVR (8.5.48 and older)

Affected: 8.5.48 and older
Fixed in: 8.5.49
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.48.

NVD CVE-2025-62885 Patchstack advisory

medium 4.3 CVE-2025-12005 · published 2025-10-25

Missing authorization check in WPVR (8.5.41 and older)

Affected: 8.5.41 and older
Fixed in: 8.5.42 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.

NVD CVE-2025-12005 Wordfence advisory Plugin source

medium 5.4 CVE-2025-6350 · published 2025-06-28

Stored cross-site scripting (XSS) in WPVR (8.5.32 and older)

Affected: 8.5.32 and older
Fixed in: 8.5.33 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

NVD CVE-2025-6350 Wordfence advisory Code change (fix)Plugin source

critical 9.9 CVE-2025-47452 · published 2025-06-17

Arbitrary file upload in WPVR (8.5.26 and older)

Affected: 8.5.26 and older
Fixed in: 8.5.27
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through <= 8.5.26.

NVD CVE-2025-47452 Patchstack advisory

medium 6.5 CVE-2025-24730 · published 2025-01-24

Cross-site scripting (XSS) in WPVR (8.5.14 and older)

Affected: 8.5.14 and older
Fixed in: 8.5.15
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.

NVD CVE-2025-24730 Patchstack advisory

medium 4.3 CVE-2024-49680 · published 2024-11-19

Missing authorization check in WPVR (8.5.5 and older)

Affected: 8.5.5 and older
Fixed in: 8.5.6
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.5.

NVD CVE-2024-49680 Patchstack advisory

medium 5.4 CVE-2024-49293 · published 2024-10-21

Missing authorization check in WPVR (8.5.4 and older)

Affected: 8.5.4 and older
Fixed in: 8.5.5
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.4.

NVD CVE-2024-49293 Patchstack advisory

medium 6.1 CVE-2023-40663 · published 2023-09-27

Reflected cross-site scripting (XSS) in WPVR (8.3.4 and older)

Affected: 8.3.4 and older
Fixed in: 8.3.5
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.

NVD CVE-2023-40663 Patchstack advisory

high 8.8 CVE-2023-25708 · published 2023-03-15

Cross-site request forgery (CSRF) in WPVR (8.2.7 and older)

Affected: 8.2.7 and older
Fixed in: 8.2.8
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.

NVD CVE-2023-25708 Patchstack advisory

Recent activity

2026-10-16 — latest release on wordpress.org (9.3.1).
2026-10-25 — Missing authorization check disclosed (CVE-2026-114740), fixed in 9.1.3.
2026-10-25 — Missing authorization check disclosed (CVE-2026-114741), fixed in 9.0.3.
2026-10-25 — Missing authorization check disclosed (CVE-2026-114742), fixed in 9.0.3.

Free. We check the CVE feeds every day and email you only when a new issue for WPVR (wpvr) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (7) · Cross-site scripting (XSS) (5) · Arbitrary file upload (1) · Cross-site request forgery (CSRF) (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/wpvr (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/wpvr"><img src="https://laskyr.com/plugins/wpvr/badge.svg" alt="WPVR vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is WPVR safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (9.3.1)

What to do

Check your version

Known vulnerabilities

Missing authorization check in WPVR (8.5.55 up to (not including) 9.1.3)

Missing authorization check in WPVR (9.0.0 up to (not including) 9.0.3)

Missing authorization check in WPVR (8.3.0 up to (not including) 9.0.3)

Stored cross-site scripting (XSS) in WPVR (8.5.49 up to (not including) 9.0.3)

Missing authorization check in WPVR (9.1.3 and older)

Cross-site scripting (XSS) in WPVR (8.5.48 and older)

Missing authorization check in WPVR (8.5.41 and older)

Stored cross-site scripting (XSS) in WPVR (8.5.32 and older)

Arbitrary file upload in WPVR (8.5.26 and older)

Cross-site scripting (XSS) in WPVR (8.5.14 and older)

Missing authorization check in WPVR (8.5.5 and older)

Missing authorization check in WPVR (8.5.4 and older)

Reflected cross-site scripting (XSS) in WPVR (8.3.4 and older)

Cross-site request forgery (CSRF) in WPVR (8.2.7 and older)

Recent activity

Get an email when WPVR has a new vulnerability

Browse vulnerabilities

Where this data comes from