CVE-2026-111840: WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The issue is remotely reachable, requires no privileges, and has low attack complexity. However, exploitation requires user interaction, consistent with a reflected XSS attack.

Q: What impact could successful exploitation have?

Successful exploitation can affect confidentiality, integrity, and availability at a low level. The CVSS vector also indicates scope change, meaning the impact may extend beyond the vulnerable component's original security authority.

Q: Which plugin versions are affected?

Paid Videochat Turnkey Site versions through 7.5.14 are affected. The available data does not identify a fixed version.

Published Oct 21, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.

Affected Software

1 affected component

VideoWhisper.com Paid Videochat Turnkey Site<=7.5.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Paid Videochat Turnkey Site plugin to a version that resolves this vulnerability.
Fixed in 7.5.15

Event History

Oct 21, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is remotely reachable, requires no privileges, and has low attack complexity. However, exploitation requires user interaction, consistent with a reflected XSS attack.

What impact could successful exploitation have?