CVE-2026-107421
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.2 contains a Session Fixation vulnerability that allows session hijacking.
Risk Assessment
An attacker can exploit the vulnerability to hijack a logged-in user's session, potentially leading to unauthorized access to the account and data.
Recommendation
Update the Broadcast Live Video plugin to a patched version and implement session ID regeneration after login.
Other vulnerabilities in Broadcast Live Video
See all- CVE-2026-57716Medium
Broadcast Live Video plugin version 7.2.4 and earlier allows an unauthenticated attacker to arbitrarily delete files. The attacker can delete critical system files.
- CVE-2026-27053Critical
In Broadcast Live Video versions below 7.1.3, there is a vulnerability to unauthenticated PHP object injection.
- CVE-2026-108475Medium
The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.6 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
- CVE-2026-24937High
The Broadcast Live Video plugin by VideoWhisper.Com for WordPress before version 7.1.3 contains a Code Injection vulnerability. This allows an attacker to inject and execute arbitrary code.
Original NVD description (English source)
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS