What is the CVSS score of CVE-2026-24937?

CVE-2026-24937 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Broadcast Live Video are affected by CVE-2026-24937?

A code injection vulnerability in the VideoWhisper Broadcast Live Video WordPress plugin (versions before 7.1.3) could allow a compromised administrator account to execute malicious code on your…. A patch is available.

How to fix or mitigate CVE-2026-24937?

Within 24 hours: Identify all WordPress sites using the VideoWhisper Broadcast Live Video plugin and confirm their current versions. Within 7 days: Test version 7.1.3 patch in non-production environments, then begin deployment to production systems. Within 30 days: Complete patch deployment to all production systems and audit administrator access logs for any suspicious activity.

Broadcast Live Video CVE-2026-24937

EUVD-2026-31763 HIGH

Code Injection (CWE-94)

2026-05-25 Patchstack

GHSA-296g-v265-85g6

Code Injection RCE Broadcast Live Video

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:46 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection.

This issue affects Broadcast Live Video: from n/a before 7.1.3.

AnalysisAI

Authenticated code injection in the VideoWhisper Broadcast Live Video WordPress plugin (versions before 7.1.3) lets a high-privileged user execute arbitrary PHP on the underlying host, yielding full confidentiality, integrity, and availability loss on the WordPress instance. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.04% (14th percentile), but SSVC rates the technical impact as total. A vendor patch is available in 7.1.3.

Technical ContextAI

The affected component is the VideoWhisper Live Streaming Integration plugin (marketed as 'Broadcast Live Video') for WordPress, identified by CPE cpe:2.3:a:videowhisper.com:broadcast_live_video. The root cause is CWE-94, Improper Control of Generation of Code ('Code Injection'), meaning attacker-controlled input is incorporated into a code construct (typically PHP eval/include or template evaluation) that the WordPress runtime then executes. Patchstack - a WordPress-focused vulnerability database - coordinated disclosure, which is consistent with the issue residing in a plugin admin or broadcast configuration path that fails to sanitize input before passing it to a code evaluation sink.

RemediationAI

Vendor-released patch: 7.1.3 - upgrade the VideoWhisper Live Streaming Integration plugin to 7.1.3 or later via the WordPress plugin updater or by replacing the plugin directory from the official source, then verify the installed version under Plugins. Patchstack's advisory (https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-1-3-remote-code-execution-rce-vulnerability) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-24937) are the authoritative references. If immediate patching is not possible, compensating controls include deactivating the plugin (loses broadcast functionality but eliminates the sink entirely), restricting WordPress administrator accounts to enforced MFA and IP allowlisting on /wp-admin (reduces the population that can reach the high-privilege code path at the cost of admin convenience), and placing a virtual patch / WAF rule from Patchstack or an equivalent WordPress security provider in front of the plugin's admin endpoints (introduces latency and potential false positives on legitimate broadcast configuration changes).