CVE-2026-107428: WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcamsto a version that resolves this vulnerability.Fixed in 7.5.13
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be performed remotely with low complexity and does not require authentication. It does require user interaction, meaning a victim must be induced to access attacker-controlled content or a crafted request.
Which installations are affected?
Paid Videochat Turnkey Site versions through 7.5.12 are affected. The available data does not identify a safe fixed version or any configuration-specific prerequisites.
What is the likely impact if exploitation succeeds?
Successful reflected XSS may allow code to run in a victim's browser in the context of the affected site. The reported impact includes low confidentiality, integrity, and availability effects, and the scope may extend beyond the vulnerable component.