CVE-2026-107428 VideoWhisper.com CVE debrief

Who should care

Defenders responsible for WordPress environments with the Paid Videochat Turnkey Site plugin installed should assess exposure and prioritize verification and updates to prevent potential XSS attacks. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified. The vulnerability affects versions up to 7.5.12 and has been assessed as HIGH severity. Defenders should verify and update the plugin to version

Why it matters

CVE-2026-107428 is a Cross Site Scripting (XSS) vulnerability in the Paid Videochat Turnkey Site plugin, with a CVSS score of 7.1 and HIGH severity, affecting versions up to 7.5.12. Defenders responsible for WordPress environments with this plugin installed should assess exposure and prioritize verification and updates to prevent potential XSS attacks.

• Defenders should verify and update the Paid Videochat Turnkey Site plugin to version 7.5.13 or later to prevent potential XSS attacks.
• Assess exposure in WordPress environments to determine potential impact.
• Monitor for potential XSS attacks to detect possible exploitation.

Technical summary

The Paid Videochat Turnkey Site plugin has a Cross Site Scripting (XSS) vulnerability, with a CVSS score of 7.1 and HIGH severity, affecting versions up to 7.5.12. The vulnerability is caused by improper neutralization of input during web page generation. Defenders should prioritize verifying and updating the Paid Videochat Turnkey Site plugin to version 7.5.13 or later, and assess exposure in their WordPress environments. The vulnerability has been assessed as HIGH severity and has a CVSS score of 7.1. The Paid Videochat Turnkey Site plugin is used in WordPress environments.

Defensive priority

Defenders should prioritize verifying and updating the Paid Videochat Turnkey Site plugin to version 7.5.13 or later, and assess exposure in their WordPress environments.

Recommended defensive actions

• Verify and update the Paid Videochat Turnkey Site plugin to version 7.5.13 or later
• Assess exposure in WordPress environments
• Monitor for potential XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the Cross Site Scripting (XSS) vulnerability in the Paid Videochat Turnkey Site plugin, with a CVSS score of 7.1 and HIGH severity. The vulnerability affects versions up to 7.5.12 and has been assessed as HIGH severity. Defenders should verify and update the plugin to version 7.5.13 or later. The source item provides additional context on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.