EUVD-2026-31763
GHSA-296g-v265-85g6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection.
This issue affects Broadcast Live Video: from n/a before 7.1.3.
AnalysisAI
Authenticated code injection in the VideoWhisper Broadcast Live Video WordPress plugin (versions before 7.1.3) lets a high-privileged user execute arbitrary PHP on the underlying host, yielding full confidentiality, integrity, and availability loss on the WordPress instance. No public exploit identified at time of analysis, and EPSS exploitation probability sits at 0.04% (14th percentile), but SSVC rates the technical impact as total. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high privileges on the WordPress instance (CVSS PR:H), which in practice means an administrator-class account able to reach the VideoWhisper Broadcast Live Video plugin's configuration or broadcast-management interface; the plugin must be installed and active at a version below 7.1.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk is moderate and conditional, not urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WordPress administrator credentials - for example via phishing, credential reuse, or a prior privilege escalation - logs into wp-admin and submits a crafted value to a Broadcast Live Video configuration field that is later evaluated as PHP, causing the WordPress process to execute attacker-supplied code and giving the attacker a webshell on the host. No public POC is currently identified, so any attempt would require independent vulnerability research against the patched 7.1.3 diff. |
| Remediation | Vendor-released patch: 7.1.3 - upgrade the VideoWhisper Live Streaming Integration plugin to 7.1.3 or later via the WordPress plugin updater or by replacing the plugin directory from the official source, then verify the installed version under Plugins. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress sites using the VideoWhisper Broadcast Live Video plugin and confirm their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today