WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress Security & Risk Analysis

The wpvr plugin v8.5.62 exhibits a mixed security posture. While it shows some good practices like a high percentage of SQL queries using prepared statements and a significant number of nonce and capability checks, several concerning areas stand out. The presence of an unprotected AJAX handler significantly increases the attack surface, as it represents a direct entry point that can be exploited without authentication. Furthermore, the static analysis reveals the use of dangerous functions (preg_replace(/e)) which can be a vector for code injection if not handled with extreme care. Taint analysis, though with a small sample size, flagged a flow with an unsanitized path, indicating potential for vulnerabilities if user-supplied data is not properly validated before being used in sensitive operations.

The vulnerability history of this plugin is a significant red flag. With a total of 14 known CVEs, including 2 high-severity ones, it demonstrates a pattern of past security weaknesses. The common vulnerability types such as Improper Authorization, Cross-Site Scripting, and CSRF suggest recurring issues with how the plugin handles user input and access control. Although there are currently no unpatched CVEs, the historical prevalence of these issues suggests a higher inherent risk for this plugin. The recent vulnerability in late 2025 also indicates ongoing discovery of flaws.

In conclusion, while the plugin incorporates some security best practices, the unprotected AJAX endpoint, use of dangerous functions, and a concerning history of vulnerabilities, especially those related to authorization and input sanitization, warrant careful consideration. The risk is elevated due to the combination of exploitable entry points and a history of common web application vulnerabilities. Vigilance and prompt updates are crucial when using this plugin.