RexTheme WP VR vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Latest RexTheme WP VR vulnerabilities

CVE-2025-62885 — WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2025-12005 — WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update (CVSS 4.3)
CVE-2025-6350 — WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
CVE-2025-47452 — WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability (CVSS 9.9)
CVE-2025-24730 — WordPress WP VR plugin <= 8.5.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
CVE-2024-49680 — WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability (CVSS 4.3)
CVE-2024-49293 — WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability (CVSS 5.4)
CVE-2023-6529 — WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS (CVSS 6.1)
CVE-2023-40663 — WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
CVE-2023-1414 — WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update (CVSS 4.3)
CVE-2023-1413 — WP VR < 8.2.9 - Reflected XSS (CVSS 6.1)
CVE-2023-25708 — WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
CVE-2023-0174 — WP VR < 8.2.7 - Contributor+ Stored XSS (CVSS 5.4)