6.1
Medium
CVE-2023-6529 The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing…
Description
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP VR 8.3 | earliest → < 8.3.15 | 8.3.15 |
Other CVEs of WP VR
The 4 CVEs of WP VR →
CVE-2023-1414
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in…
4.3
Medium
CVE-2023-1413
The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in…
6.1
Medium
CVE-2023-0174
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before…
5.4
Medium