CVE-2026-107428: Paid Videochat Turnkey Site XSS Vulnerability

CVE-2026-107428 Overview

CVE-2026-107428 is a reflected cross-site scripting (XSS) vulnerability in the VideoWhisper.com Paid Videochat Turnkey Site plugin (ppv-live-webcams) for WordPress. The flaw results from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The issue affects all plugin versions up to and including 7.5.12. Because exploitation requires only user interaction and no authentication, publicly accessible WordPress sites running the affected plugin are at risk.

Critical Impact
Attackers can hijack sessions, steal credentials, or perform actions on behalf of authenticated administrators by luring them to a crafted URL.

Affected Products

VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) WordPress plugin
All versions from n/a through 7.5.12
WordPress installations hosting the vulnerable plugin

Discovery Timeline

2026-10-14 - CVE CVE-2026-107428 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107428

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the ppv-live-webcams plugin. The plugin accepts input from HTTP request parameters and reflects that input back into the rendered HTML response without sufficient encoding or sanitization. When a user clicks a crafted link containing malicious JavaScript, the payload is included in the server's response and executed in the user's browser under the origin of the vulnerable WordPress site.

Successful exploitation allows an attacker to run arbitrary script in the context of the victim. Impact scenarios include session cookie theft, forced browser actions against authenticated administrator sessions, phishing overlays rendered on legitimate pages, and redirection to attacker-controlled infrastructure. The scope-changed classification indicates the injected script can affect resources beyond the vulnerable component itself.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to apply output encoding appropriate for the HTML context when echoing user-controlled values. Standard WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() were not applied consistently to the affected request parameters.

Attack Vector

Exploitation occurs over the network and requires user interaction. An unauthenticated attacker crafts a URL containing a JavaScript payload in a vulnerable parameter and delivers it through phishing email, forum posts, chat messages, or malicious advertising. When the target visits the URL on a site running ppv-live-webcams ≤ 7.5.12, the browser renders the attacker's script. Refer to the Patchstack XSS Vulnerability Report for additional context.

No verified proof-of-concept code is published. The vulnerability manifests when unsanitized request parameters are reflected into the HTML response of plugin-generated pages.

Detection Methods for CVE-2026-107428

Indicators of Compromise

HTTP request logs containing <script>, javascript:, onerror=, or onload= tokens in query strings targeting ppv-live-webcams endpoints
URL-encoded script payloads such as %3Cscript%3E or %3Cimg%20src%3Dx%20onerror%3D directed at plugin URLs
Outbound requests from administrator browsers to unknown domains shortly after visiting plugin pages
Unexpected creation of WordPress administrator accounts or modified user roles following a successful phishing campaign

Detection Strategies

Inspect web server access logs for anomalous parameter values on URLs served by the ppv-live-webcams plugin
Deploy a web application firewall (WAF) rule set that blocks reflected XSS patterns on WordPress endpoints
Monitor browser Content Security Policy (CSP) violation reports from pages served by the plugin
Correlate referrer headers pointing to external domains with subsequent authenticated administrator activity

Monitoring Recommendations

Enable verbose logging on the WordPress host and forward logs to a centralized SIEM for correlation
Alert on sudden spikes in 200-response traffic to plugin URLs containing script-like characters
Track plugin version inventory across all WordPress properties to confirm patched state
Monitor administrator session activity for anomalous POST requests originating immediately after link clicks

How to Mitigate CVE-2026-107428

Immediate Actions Required

Update the ppv-live-webcams plugin to the latest version released after 7.5.12 as soon as the vendor publishes a fix
If no patch is available, deactivate and remove the plugin until a fixed release is published
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected
Review user accounts and recent configuration changes for signs of unauthorized activity

Patch Information

At the time of publication, consult the Patchstack advisory for the current patched version and vendor guidance. Apply the fixed release through the WordPress plugin manager or by replacing the plugin files directly.

Workarounds

Deploy a WAF rule that blocks HTTP requests containing script tags or JavaScript event handlers against ppv-live-webcams routes
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Restrict access to the WordPress admin interface by IP allowlist to reduce administrator exposure to phishing links
Train administrators to avoid clicking unsolicited links that target the organization's WordPress properties

bash

# Example WAF rule concept (ModSecurity) blocking reflected XSS patterns on plugin paths
SecRule REQUEST_URI "@contains /ppv-live-webcams/" \
    "id:1072026107428,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential CVE-2026-107428 XSS attempt',\
    chain"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" \
        "t:urlDecodeUni,t:htmlEntityDecode"