$PATCH CAsoon

Advisory feed · Saturday, 24 October 20264,531 CVEs published in the last 7 daysSource: saved copy of NVD from 24 Oct (NVD isn’t answering)Advisory feedDemo · pretend coins and SOL. The CVE records are real.

TLP:CLEARReceivedPublished 24 Oct 2026 · Updated 24 Oct 2026

CVE-2026-114429

·Not scored yetNo CVSS score yet

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

No CVSS vector yet. NVD or the CNA hasn’t scored this record.

Affected software: WPVR
Versions: 8.5.49 up to 9.0.3
Weakness: Not stated
Assigned by: wpscan.com
NVD status: Received

ReferencesNVD https://nvd.nist.gov/vuln/detail/CVE-2026-114429 CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114429 https://wpscan.com/vulnerability/30409336-b8ed-49f7-bc40-96c21f494155/

The record above is NVD’s, word for word, as read before NVD finished its analysis. Coins say nothing about the flaw.

Launch a coin on CVE-2026-114429

Coins filed under CVE-2026-114429

No coins filed yet.

Be the first to file a coin under CVE-2026-114429.

File the first coin

CVE-2026-114429 · Patch Day