CVE-2025-12005mediumCWE-285

CVE-2025-12005: falha de média gravidade em rextheme WP VR – 360 Panorama and Free Virtual…

WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.2%
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
rextheme · WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress
CVEs relacionadas — rextheme WP VR – 360 Panorama and Free Virtual…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-6350MEDIUMWP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%