CVE-2023-6529: WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-08 · updated 2026-06-17
Weakness: CWE-79

Description

The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.

Affected products

RexTheme WP VR: before 8.3.15 — fixed in 8.3.15

How to fix

Upgrade to a fixed version: RexTheme WP VR 8.3.15. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/c36314c1-a2c0-4816-93c9-e61f9cf7f27a
https://wpscan.com/vulnerability/c36314c1-a2c0-4816-93c9-e61f9cf7f27a

Get alerted when CVE-2023-6529 or the next vulnerability affects your stack