Paid Videochat Turnkey Site CVE-2026-111840

Exploitation requires a victim with an active session on a WordPress site running the ppv-live-webcams (Paid Videochat Turnkey Site) plugin version 7.5.14 or earlier to click an attacker-crafted link (UI:R), so the attack is not self-propagating and cannot be triggered against the server directly. No authentication is required of the attacker (PR:N), but the impact is realized in the victim's browser context, meaning the practical payoff depends on luring a privileged user (e.g., an administrator or paying member). The reflected nature means the payload is not persisted, limiting exploitation to targeted, per-victim delivery rather than broad drive-by compromise; the main limiting factors are the required user interaction and the plugin's limited deployment.

This is a medium-to-high severity reflected cross-site scripting flaw (CVSS 7.1) in the VideoWhisper 'Paid Videochat Turnkey Site' (ppv-live-webcams) WordPress plugin, affecting versions up to and including 7.5.14, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates a network-reachable, low-complexity, unauthenticated attack that requires user interaction and crosses a security scope boundary - consistent with reflected XSS where a victim must click a crafted link but the injected script executes in their authenticated browser context. No EPSS probability, CISA KEV listing, or public POC is present in the provided intelligence, so there is no evidence of active exploitation or weaponization; the real-world risk is currently theoretical and gated by social engineering. The elevated 7.1 score is driven largely by the scope change (S:C) and triple low impact (C:L/I:L/A:L), but reflected XSS typically has no genuine availability impact - the A:L component appears generous and should be treated with caution. Net assessment: a legitimate issue worth patching, but not an emergency relative to unauthenticated stored XSS or RCE; prioritize based on whether this niche plugin is actually deployed.

An attacker crafts a malicious URL targeting a vulnerable parameter on a site running the Paid Videochat Turnkey Site plugin and delivers it to a logged-in user or administrator via phishing, chat, or a malicious page. When the victim clicks the link, the reflected payload executes in their browser session, allowing session/cookie theft, forced actions, or UI redress within the WordPress context. No public exploit code is identified at time of analysis, and exploitation depends entirely on the victim interacting with the attacker-supplied link.