CVE-2026-27333

The Paid Videochat Turnkey Site plugin by VideoWhisper.com up to version 7.5.12 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Performer Arbitrary File Deletion vulnerability in Paid Videochat Turnkey Site versions up to 7.4.8 allows an attacker to delete arbitrary files on the server. This flaw can be exploited to remove critical system or application files.

The Paid Videochat Turnkey Site (ppv-live-webcams) plugin for WordPress is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions from n/a through 7.5.12.

The Paid Videochat Turnkey Site plugin by VideoWhisper.com up to version 7.5.13 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Paid Videochat Turnkey Site plugin (up to version 7.5.12) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to unexpected application behavior.

The Paid Videochat Turnkey Site plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Versions up to 7.3.23 are affected.