CVE-2026-107428
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Paid Videochat Turnkey Site (ppv-live-webcams) plugin for WordPress is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions from n/a through 7.5.12.
Risk Assessment
An attacker could trick a user into clicking a crafted link, allowing execution of arbitrary script in the victim's browser within the site context, enabling session or data theft.
Recommendation
Update the Paid Videochat Turnkey Site plugin to a version newer than 7.5.12. Consider disabling the plugin until updated.
Other vulnerabilities in Paid Videochat Turnkey Site
See all- CVE-2026-107426High
The Paid Videochat Turnkey Site plugin by VideoWhisper.com up to version 7.5.12 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
- CVE-2026-57331Critical
The Performer Arbitrary File Deletion vulnerability in Paid Videochat Turnkey Site versions up to 7.4.8 allows an attacker to delete arbitrary files on the server. This flaw can be exploited to remove critical system or application files.
- CVE-2026-108476Medium
The Paid Videochat Turnkey Site plugin by VideoWhisper.com up to version 7.5.13 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.
- CVE-2026-107429Medium
The Paid Videochat Turnkey Site plugin (up to version 7.5.12) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to unexpected application behavior.
- CVE-2026-27333High
Paid Videochat Turnkey Site versions up to 7.3.23 are vulnerable to unauthenticated deserialization of untrusted data.
- CVE-2026-24590Medium
The Paid Videochat Turnkey Site plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Versions up to 7.3.23 are affected.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS