WordPress Plugin Vulnerabilities

Outdated VRView Library Used, Leading to Reflected XSS

Description

The vrview (<= 1.1.3) and wp-vr-view (<= 1.6) plugins are using an outdated version of the VRView library (< 2.0.2), which is affected by a reflected cross-site scripting issue.

Proof of Concept

Affects Plugins

Plugin icon
vrview
No known fix
Plugin icon
wp-vr-view
No known fix

References

URL
https://blog.mindedsecurity.com/2018/04/dom-based-cross-site-scripting-in.html

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Federico Fazzi (mindedsecurity.com)
Verified
Yes
WPVDB ID
fdff61d9-f236-474f-ac3e-90def10c004b

Timeline

Publicly Published
2018-04-23 (about 8 years ago)
Added
2020-06-08 (about 5 years ago)
Last Updated
2021-09-06 (about 4 years ago)

Other

Published
Title
Published
2024-11-27
Title
Ragic Shortcode < 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-12-06
Title
Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting
Published
2025-01-16
Title
Category D3 Tree <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-03-17
Title
Surbma | GDPR Proof Cookie Consent & Notice Bar < 17.6.0 - Contributor+ Stored Cross-Site Scripting
Published
2014-08-01
Title
Classic 1.5 - PHP_SELF XSS