SwiftXR (3D/AR/VR) Viewer
SwiftXR (3D/AR/VR) Viewer has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for SwiftXR (3D/AR/VR) Viewer has a vendor fix available, so running the current release closes it.
All of these findings were reported by Affan Ali. SwiftXR (3D/AR/VR) Viewer is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2025-32248SwiftXR (3D/AR/VR) Viewer <= 1.0.7 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

SwiftXR (3D/AR/VR) Viewer
Author
SwiftXR
Help visitors understand your products and ideas through interactive experiences. SwiftXR adds 3D, augmented reality (AR) and virtual reality (VR) to WordPress pages, posts, widgets and WooCommerce product pages. Visitors can rotate and zoom models, explore colour options, preview products in their space or enter Web VR. Create and publish an experience in SwiftXR, then add it to your site with a shortcode or connect it directly to a WooCommerce product. Set the viewer size and choose its position on the product page from the plugin dashboard. Build with the SwiftXR visual editor, or use SwiftXR Assistant to refine lighting, camera angles and other scene settings through conversation. Upload your own 3D models, choose from the built-in library or generate a model from a product image. Published experiences are responsive and work in modern desktop and mobile browsers. Use SwiftXR analytics to track views, engagement and visitor actions. AI tools, advanced analytics and branding options depend on your SwiftXR plan. Features WooCommerce integration – Connect a published SwiftXR experience to a product and choose where the viewer appears. Shortcode embedding – Add an experience to pages, posts, widgets and compatible page builders. Interactive 3D, AR and Web VR – Let visitors inspect products and preview them in their environment. Visual editor and SwiftXR Assistant – Customise scenes visually or refine them through conversation. Flexible 3D content – Upload supported models, choose from the library or generate a model from an image. Built-in analytics – See views, engaged visits and visitor actions in the SwiftXR dashboard. Learn more at https://home.swiftxr.io/ External Service This plugin connects your site to SwiftXR, a hosted service used to create, host and publish the 3D, AR and VR experiences embedded by the plugin. A SwiftXR account is required to create and publish a project. When you add a published SwiftXR project URL, the plugin stores that URL and the viewer settings on your WordPress site. On the public page, the embedded viewer loads the published experience and its assets from SwiftXR. SwiftXR also processes the requests and interaction data needed to deliver the experience and provide analytics. Service: https://home.swiftxr.io/ Terms of Service: https://swiftxr-wiki.notion.site/SwiftXR-Terms-of-Service-1ddd5d12803980f8bd23c9665ffb2a57 Privacy Policy: https://swiftxr-wiki.notion.site/SwiftXR-Privacy-Policy-1c9d5d128039800ba887eb94682e47d2
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C