ppv-live-webcams CVE-2026-107428

Exploitation requires a victim with an active session on a site running the Paid Videochat Turnkey Site (ppv-live-webcams) plugin to click an attacker-crafted link that injects script into a reflected parameter; this user-interaction requirement (UI:R) is the primary limiting factor. No authentication is required of the attacker (PR:N), and the attack works against network-reachable installations, but it is not self-triggering - it depends on social engineering to deliver the malicious URL. The specific vulnerable parameter/endpoint is not disclosed in the provided data. Impact scales with the privilege of the victim who is lured (e.g. an administrator click enables higher-value session abuse).

This is a reflected cross-site scripting (CWE-79) flaw in the VideoWhisper 'Paid Videochat Turnkey Site' WordPress plugin (ppv-live-webcams), affecting all versions up to and including 7.5.12. The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - network-reachable, low complexity, no privileges, but requiring user interaction and with a changed scope that yields the elevated score. No EPSS probability, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is moderate rather than urgent: reflected XSS requires socially engineering a victim (UI:R) into clicking an attacker-crafted link, so it is not self-propagating or automatable like a stored or unauthenticated-RCE issue. The 7.1 score is driven largely by the S:C scope change (script executing in the victim's browser context) and the sum of three Low impacts, which is typical Patchstack scoring for reflected XSS; it should be read as a high-CVSS-but-conditional-risk issue rather than a mass-exploitation priority. Note: exploitation requires a victim click, so raw severity overstates likelihood of opportunistic attack.

An attacker crafts a URL for a vulnerable parameter of the Paid Videochat plugin that reflects unsanitized input into the generated page, embedding malicious JavaScript. The attacker delivers this link to a logged-in site user or administrator (via phishing, chat, or a malicious post), and when the victim clicks it the script executes in their browser session, enabling session/cookie theft or actions in the victim's context. No public exploit code was identified in the provided data, but reflected XSS of this type is trivially weaponizable once the vulnerable parameter is known.