VULNERABILITY INTELLIGENCE

CVE-2023-6529

CVSS score6.1 MEDIUM

EPSS probability0.22%

CISA KEVNot currently listed

Published2024-01-08

Last modified2026-06-17

Description

The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.