Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site… (CVE-2026-111840)

CVE-2026-111840 describes a reflected cross-site scripting (XSS) vulnerability in VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) affecting versions up to and including 7.5.14. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the victim's browser. The CVSS v3.1 score of 7.1 reflects a high severity with network attack vector, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in information disclosure, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the system.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules or input validation as temporary mitigations.