Cross-site Scripting Vulnerability in VideoWhisper's Paid Videochat Turnkey Site
CVE-2026-107428

7.1HIGH

Key Information:

Vendor

WordPress
Status
Paid Videochat Turnkey Site
Vendor
CVE Published:
14 October 2026

What is CVE-2026-107428?

The Paid Videochat Turnkey Site by VideoWhisper is susceptible to a reflected cross-site scripting (XSS) vulnerability that arises from the improper neutralization of user input during the web page generation process. Attackers can exploit this vulnerability to inject malicious scripts, potentially leading to unauthorized access or manipulation of user sessions and sensitive information. Users of versions from n/a to 7.5.12 should implement the latest security patches to mitigate any security risks associated with this vulnerability.

Affected Version(s)

Paid Videochat Turnkey Site 0 <= 7.5.12

References

https://patchstack.com/database/wordpress/plugin/ppv-live...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erik Debye | Patchstack Bug Bounty Program
.