Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WPVR 9.0.3 Clear all filters
TI-2026-80107 CVE-2026-114742 · GHSA-jgxg-6f9p-7gm5

Missing ownership checks in WPVR plugin let contributors edit tours

Priority LOW 13

The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created b…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00168 Published 2026-10-25 Fixed in 9.0.3 CWE-639
TI-2026-80106 CVE-2026-114741 · GHSA-vqjh-3q2x-jp9r

WPVR plugin lets contributors read and change other users' tours

Priority LOW 17

The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created b…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00152 Published 2026-10-25 Fixed in 9.0.3 CWE-639