Skip to content
OpenAdvisories

Vendor

RexTheme

17 known vulnerabilities.

Products

WP VR 6 Product Feed Manager 4 WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress 2 Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD 1 WP VR – 360 Panorama and Virtual Tour Builder For WordPress 1 Cart Lift 1 Change WooCommerce Add To Cart Button Text 1 Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-15306

    Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter

    The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and ou…

    RexTheme Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces Web / CMS
  • Medium 6.5
    CVE-2025-62885

    WordPress WP VR plugin <= 8.5.48 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.48.

    RexTheme WP VR
  • Medium 4.3
    CVE-2025-12005

    WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update

    The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to …

    RexTheme WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress Web / CMS
  • Medium 6.4
    CVE-2025-6350

    WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and ou…

    RexTheme WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress Web / CMS
  • Medium 6.5
    CVE-2025-24730

    WordPress WP VR plugin <= 8.5.14 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.14.

    RexTheme WP VR
  • Medium 5.4
    CVE-2023-34376

    WordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3.

    RexTheme Change WooCommerce Add To Cart Button Text Web / CMS
  • Medium 4.3
    CVE-2024-49680

    WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.5.

    RexTheme WP VR
  • Medium 4.3
    CVE-2024-49293

    WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.4.

    RexTheme WP VR
  • Medium 5.5
    CVE-2023-52144

    WordPress Product Feed Manager plugin <= 7.3.15 - Directory Traversal vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed Manager: from n/a through 7.3.15.

    RexTheme Product Feed Manager
  • Medium 4.3
    CVE-2023-25708

    WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.

    RexTheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress Web / CMS