CVE-2025-6350: WP VR WordPress Plugin XSS Vulnerability

CVE-2025-6350 Overview

The WP VR – 360 Panorama and Free Virtual Tour Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 8.5.32. The flaw exists in the hotspot-hover parameter, where the plugin fails to properly sanitize input and escape output. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute whenever a visitor loads an affected page. The vulnerability is tracked as [CWE-79] and carries a CVSS score of 5.4.

Critical Impact
Authenticated attackers with Contributor privileges can inject persistent JavaScript that executes in the browser context of any user viewing an affected virtual tour page, enabling session hijacking, credential theft, and administrative account takeover.

Affected Products

Rextheme WP VR – 360 Panorama and Free Virtual Tour Builder for WordPress
All versions up to and including 8.5.32
CPE: cpe:2.3:a:rextheme:wp_vr:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2025-06-28 - CVE-2025-6350 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6350

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue classified under [CWE-79]. WP VR allows users to configure interactive hotspots within 360-degree virtual tours. The hotspot-hover parameter accepts user-supplied content that is later rendered in generated tour pages. The plugin does not sanitize this input on submission, nor does it escape the value on output. As a result, any HTML or JavaScript payload persists in the WordPress database and executes in the browser of every visitor loading the affected tour.

The injection is persistent, meaning a single successful write results in repeated execution across all users who load the compromised page. Because Contributor accounts are common on multi-author WordPress sites and can often be obtained through registration or low-effort social engineering, the barrier to exploitation is low.

Root Cause

The root cause is missing input sanitization and missing output escaping around the hotspot-hover parameter handled by the plugin's AJAX class. The vulnerable code path resides in class-wpvr-ajax.php (see referenced line 171 in the WordPress Plugin AJAX Class). The plugin stores the raw value and later renders it into the DOM without applying WordPress escaping helpers such as esc_attr() or esc_html().

Attack Vector

Exploitation requires an authenticated session with at least Contributor privileges. The attacker submits a crafted hotspot-hover value containing a JavaScript payload through the plugin's tour-editing interface. The payload is stored in the database. When any user — including administrators — views a page containing the affected virtual tour, the payload executes in their browser session. This enables cookie theft, session hijacking, forced administrative actions via CSRF, and privilege escalation through account takeover. The attack requires user interaction (viewing the page) and crosses a security scope boundary because a low-privileged Contributor can affect higher-privileged users.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2025-6350

Indicators of Compromise

Virtual tour hotspot configurations containing <script> tags, javascript: URIs, or HTML event handlers such as onerror=, onload=, or onmouseover= in the hotspot-hover field.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that embed WP VR tours.
WordPress wp_posts or plugin-specific tables containing serialized hotspot data with encoded or obfuscated script payloads.
Contributor-role accounts creating or modifying wpvr post types outside normal editorial workflows.

Detection Strategies

Query the WordPress database for WP VR tour records and inspect stored hotspot metadata for HTML tags and JavaScript event handlers.
Deploy a Web Application Firewall (WAF) rule that inspects AJAX requests to the WP VR endpoint for script-like payloads in the hotspot-hover parameter.
Review WordPress audit logs for hotspot modifications made by Contributor-level accounts.
Scan rendered pages containing WP VR shortcodes for inline scripts that do not match expected plugin output.

Monitoring Recommendations

Enable WordPress activity logging to record all post edits, plugin configuration changes, and Contributor account actions.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages containing virtual tours.
Alert on new or modified wpvr posts submitted by non-editorial accounts.
Track anomalous authenticated sessions performing repeated AJAX writes to WP VR endpoints.

How to Mitigate CVE-2025-6350

Immediate Actions Required

Update the WP VR plugin to a version later than 8.5.32 that contains the fix referenced in the WordPress Plugin Changeset.
Audit all existing WP VR tours for suspicious content in hotspot fields and remove any injected scripts.
Review Contributor and higher-privileged user accounts, revoking access for unknown or inactive users.
Reset passwords and invalidate active sessions for administrator accounts that may have viewed affected pages.

Patch Information

The vendor Rextheme released a fix in the changeset referenced by the WordPress plugin repository, addressing the sanitization gap in class-wpvr-ajax.php. Site operators should upgrade WP VR to the latest available version. Confirm the plugin version through the WordPress admin dashboard under Plugins after applying the update.

Workarounds

Restrict Contributor-level and above access to trusted users only until the plugin is updated.
Deploy a WAF rule to block requests containing HTML tags or JavaScript event handlers in the hotspot-hover parameter.
Temporarily disable the WP VR plugin on sites that cannot immediately update.
Implement a strict Content Security Policy that disallows inline script execution on pages hosting virtual tours.

bash

# WP-CLI: update the WP VR plugin to the latest patched release
wp plugin update wpvr

# Verify installed version
wp plugin get wpvr --field=version