CVE-2026-107428: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in VideoWhisper.com Paid Videochat Turnkey Site

The vulnerability CVE-2026-107428 in VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that are reflected back to users, potentially leading to execution of arbitrary scripts in the victim's browser session. The affected versions include all releases from the initial version up to, but not including, 7.5.13.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Attackers may execute arbitrary scripts in the context of the victim's browser, potentially stealing session tokens, defacing web content, or performing actions on behalf of the user. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor VideoWhisper.com for updates and apply any official patches once available. Until then, consider applying web application firewall (WAF) rules to detect and block reflected XSS payloads targeting the affected application.