Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.

Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.

CVE-2026-107426 is a missing authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) that affects versions from 0 up to 7.5.12. The flaw involves incorrectly configured access control security levels, allowing unauthorized access. The vulnerability has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.

CVE-2026-107421 is a session fixation vulnerability in VideoWhisper.com Broadcast Live Video software versions prior to 7.3.3. This flaw allows an attacker to hijack user sessions, potentially leading to unauthorized access. The vulnerability affects versions from initial releases up to 7.3.2. It has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector and no required privileges or user interaction.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

CVE-2026-108475 is a missing authorization vulnerability in VideoWhisper.com's Broadcast Live Video product, affecting versions from initial release up to 7.3.6. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

CVE-2026-108476 is a missing authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site affecting versions from initial through 7.5.13. The flaw involves incorrectly configured access control security levels, allowing unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.

Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

CVE-2026-107434 is a medium severity vulnerability in videowhisper MicroPayments versions up to 3.2.9. It involves improper validation of specified quantity in input, leading to a subscriber bypass issue. This flaw could allow an attacker with low privileges to cause limited integrity and availability impacts without user interaction.

Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.

Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

CVE-2026-27333 is a high-severity vulnerability in VideoWhisper.com's Paid Videochat Turnkey Site affecting versions up to and including 7.3.23. It involves unauthenticated deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-27053 is a critical vulnerability in VideoWhisper.com Broadcast Live Video versions prior to 7.1.3. It involves unauthenticated PHP object injection, classified under CWE-502 (Deserialization of Untrusted Data). This vulnerability allows remote attackers to execute arbitrary code without authentication. The CVSS score is 9.8, indicating a high severity with full impact on confidentiality, integrity, and availability.

Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.

CVE-2026-4301 is a vulnerability in the Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings WordPress plugin up to version 1.6.4. It involves missing authorization checks in an AJAX handler, allowing authenticated users with Subscriber-level access or higher to modify arbitrary posts. The vulnerability enables attackers to change post title, content, author, post type, and metadata by exploiting insufficient access controls and lack of nonce verification. This can lead to full post content takeover on affected sites.

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated attackers, with Author-level access and above, to create posts/pages with the registration form and administrator set as the role and subsequently use that form to register an administrator account. This can also be exploited by contributors, but is far less likely to be successful because an administrator would need to approve the form with the administrator role for the attack to be successful.