WP krpano is a WordPress plugin that embeds panoramic images and virtual tours created with the krpano viewer into posts and pages. Site authors add panoramas by placing a shortcode in their content and setting attributes such as the viewer location, size and title. The plugin also provides a settings page where administrators define default values for these attributes. It requires a separately licensed copy of the krpano viewer to display the panoramas. The plugin was designed for early WordPress releases and was originally built around the Flash based version of krpano. Its last released version is 1.2.1 and no newer version has been published.
WP krpano 1.2.1 and earlier is affected by a stored Cross-Site Scripting vulnerability. The plugin does not sanitize or escape the values of its shortcode attributes when it generates the page output. Any user with contributor level access or higher can add the shortcode to content. Malicious values stored this way are rendered for every visitor who opens the affected page. Because the injected code is saved in the database, it runs repeatedly without further action from the attacker. The vulnerability is tracked as CVE-2025-23876 with a CVSS score of 6.5 and no patched version is available.
The issue is located in the shortcode handler of the plugin, which builds the HTML markup used to embed a panorama. Attribute values supplied by the post author are concatenated into HTML attributes without output escaping. Contributors and other users who can create content are able to use the shortcode in their posts. When the post is viewed, the unescaped values become part of the page markup and can execute scripts in the visitor's browser. The installed plugin version is exposed through the Stable tag value in the plugin readme file. The scanner reads this readme and reports installations at version 1.2.1 or earlier.
A user with contributor access can plant scripts that run for every visitor of the affected page, including editors and administrators. When an administrator views the content, the script can act with the administrator's session and create new accounts or change site settings. Session data that is not properly protected can be stolen and used to take over accounts. Visitors can be redirected to malicious sites or shown fake forms that collect credentials. The site's content can be modified, which harms search engine reputation and user trust.
REFERENCES
- Deactivate and remove the WP krpano plugin, since no patched version has been released and the plugin is no longer maintained.
- If panoramas are still needed, move them to an actively maintained embedding method that escapes its output.
- Review existing posts and pages for krpano shortcodes and remove or clean any attribute values that contain markup or script content.
- Limit contributor and author roles to trusted users and review recently created accounts with content creation rights.
- Apply a Content Security Policy that blocks inline scripts and restricts script sources to trusted domains.
- Add plugin vulnerability monitoring to the WordPress maintenance routine so unmaintained plugins are detected early.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →