Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Unknown	n/a	CVE-2026-114742	The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114742The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to... Executive summary The WPVR WordPress plugin, which manages virtual tours, has a flaw that lets users with contributor-level access and above change virtual tours they do not own. The advisory rates the issue low severity with a CVSS score of 2.7 and says the fix is version 9.0.3. Technical summary The flaw is an insecure direct object reference (IDOR, CWE-639) caused by missing object-level ownership checks when virtual tours are updated. An attacker needs an authenticated account with contributor-level access or higher, and the advisory does not describe any other preconditions. The plugin is fixed in version 9.0.3, and versions before 9.0.3 are affected. The advisory does not state any workaround or detection guidance, and it does not say whether the issue is exploited in the wild. The CVSS score given is 2.7 (low), and the advisory does not give a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/201b0ca5-366d-…6e-a92f-6962cd200bd7 Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114741	The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114741The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access... Executive summary The WPVR WordPress plugin, before version 9.0.3, lets users with contributor-level access read and change virtual tours they should not be able to reach. The advisory rates the issue low severity with a CVSS score of 3.8, and the fix is to update to version 9.0.3 or later. Technical summary This is an insecure direct object reference (IDOR, CWE-639) caused by missing object-level authorization checks when reading and updating virtual tours in the WPVR plugin. An attacker needs contributor-level access on the WordPress site. The advisory states the affected versions as before 9.0.3 and the fixed version as 9.0.3. The advisory does not state any workaround or detection guidance, and it does not state whether the flaw is being exploited in the wild. The CVSS score given is 3.8 (low), and the advisory does not give a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/bfa704b5-b934-…15-aa75-d50b28baedf7 Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114740	The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114740The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and... Executive summary The WPVR WordPress plugin, versions before 9.1.3, contains a flaw that lets low-privileged users change site content they should not be able to change. The advisory rates it medium severity with a CVSS score of 4.9, and the fix is to update to version 9.1.3. Technical summary The flaw is a missing authorization check (CWE-862, broken access control) in the WPVR plugin's setup wizard, which does not correctly verify user capabilities when creating a tour. The advisory says users with the Contributor role and above can exploit it, which is the stated precondition. The fixed version is 9.1.3, and the affected range is versions before 9.1.3. The advisory does not state any workaround or mitigation, and it gives no detection guidance or information on exploitation in the wild. The text is truncated, so further details may be missing. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ac47bef6-b870-…ae-b9ad-ace83687280d Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-114429	The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could... WPVRWPVR	NVD	Oct 24 06:16 UTC
CVE-2026-114429The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could... Executive summary The WPVR WordPress plugin, versions before 9.0.3, contains a flaw that could let attackers inject malicious scripts into pages shown to visitors. The advisory rates it as medium severity, with a CVSS score of 6.8, and the fix is to update to version 9.0.3. Technical summary The flaw is a cross-site scripting (XSS) issue, classified as CWE-79, in which tour hotspot content is not properly sanitised or escaped before it is stored and output on the front end. The advisory does not state the exact attack preconditions beyond the description that the flaw could be exploited, so the required privilege level is not stated in the provided text. The affected version range is stated as before 9.0.3, and the fixed version is 9.0.3. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild. The CVSS score is listed as 6.8 (medium), and the advisory does not provide a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/30409336-b8ed-…f7-bc40-96c21f494155 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee