CVE-2026-24937
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Broadcast Live Video plugin by VideoWhisper.Com for WordPress before version 7.1.3 contains a Code Injection vulnerability. This allows an attacker to inject and execute arbitrary code.
Risk Assessment
Successful exploitation can lead to full compromise of the WordPress site, including database access and content modification.
Recommendation
Immediately update the Broadcast Live Video plugin to version 7.1.3 or later.
Other vulnerabilities in Broadcast Live Video
See all- CVE-2026-57716Medium
Broadcast Live Video plugin version 7.2.4 and earlier allows an unauthenticated attacker to arbitrarily delete files. The attacker can delete critical system files.
- CVE-2026-27053Critical
In Broadcast Live Video versions below 7.1.3, there is a vulnerability to unauthenticated PHP object injection.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.