VYPR
← All advisories
Medium severity6.4NVD Advisory· Published Jun 28, 2025· Updated Jun 17, 2026

CVE-2025-6350

CVE-2025-6350

Description

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Rextheme/Wp VR
    cpe:2.3:a:rextheme:wp_vr:*:*:*:*:*:wordpress:*:*
    Range: <8.5.33
  • WordPress/WP VRllm-fuzzy2 versions
    <=8.5.32+ 1 more
    • (no CPE)range: <=8.5.32
    • (no CPE)
  • rextheme/WP VR – 360 Panorama and Free Virtual Tour Builder For WordPressv5
    Range: 0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.