← CVE Intelligence

CVE-2023-6529

WP VR < 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS PUBLISHED

Description (CNA)

The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.

Affected (CNA)

Vendor / productVersions
Unknown / WP VRaffected 0 before 8.3.15

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.