CVE-2026-107428
7.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can execute malicious scripts in a user's browser context to steal sessions or manipulate page content. They need network access and must trick a user into clicking a crafted link.
Root cause
The application fails to sanitize and neutralize user-supplied input before reflecting it back in the web page response.
Affected systems
VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) through 7.5.12
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade to a version newer than 7.5.12 if available, or deactivate and remove the ppv-live-webcams plugin until a patched release is published.
$ wp plugin deactivate ppv-live-webcamsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.