Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
WPVR CVE-2026-114742
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WPVR CVE-2026-114741
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contribu
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
WPVR CVE-2026-114740
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contri
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
WPVR CVE-2026-114429
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit