2.7
Low
CVE-2026-114742 The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…
Description
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPVR 8.3 | 8.3.0 → < 9.0.3 | 9.0.3 |
Other CVEs of WPVR
The 4 CVEs of WPVR →
CVE-2026-114741
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…
3.8
Low
CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…
4.9
Medium
CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before…
6.8
Medium