{"id":"CVE-2026-111840","kind":"vulnerability","aliases":["CVE-2026-111840"],"related":[],"title":"Paid Videochat Turnkey Site: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14.","summary":"The Paid Videochat Turnkey Site plugin (ppv-live-webcams) by VideoWhisper does not neutralize user input in generated pages, enabling reflected cross-site scripting. An attacker can get a victim to open a crafted link and run script in their browser session, which can steal session cookies or act as the user.","severity":"high","cvss":7.1,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","paid-videochat","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Paid Videochat Turnkey Site / ppv-live-webcams plugin; the description says versions through `7.5.14` are affected\n- Confirm whether the plugin is installed on the site at all","fix":"- Update the Paid Videochat Turnkey Site / ppv-live-webcams plugin to a version later than `7.5.14`; the fixed version is unknown from the sources","status":"open","published_at":"2026-10-21T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:48+00:00","updated_at":"2026-10-25T03:31:48+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Paid Videochat Turnkey Site / ppv-live-webcams plugin to a version later than `7.5.14`; the fixed version is unknown from the sources","reach":"internet","title":"Paid Videochat Turnkey Site: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"The Paid Videochat Turnkey Site plugin (ppv-live-webcams) by VideoWhisper does not neutralize user input in generated pages, enabling reflected cross-site scripting. An attacker can get a victim to open a crafted link and run script in their browser session, which can steal session cookies or act as the user.","category":"other","nicknames":[],"who_cares":["wordpress","paid-videochat","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in victim browsers, stealing session cookies","analyst_note":"Find the fixed version and the vulnerable parameter or page in the NVD entry or the vendor advisory.","how_to_check":"- Check the installed version of the Paid Videochat Turnkey Site / ppv-live-webcams plugin; the description says versions through `7.5.14` are affected\n- Confirm whether the plugin is installed on the site at all","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Paid Videochat Turnkey Site (ppv-live-webcams) plugin at version 7.5.14 or earlier are affected. Sites without this plugin can skip it. The sources do not describe which page or parameter is reflected or whether authentication is required.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3368,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111840':16A,19A '-2026':15A,18A '7.5.14':117C 'act':78B 'affect':109C 'allow':105C 'attack':8A,55B 'browser':13A,70B 'cooki':76B 'craft':63B 'cross':51B,91C 'cross-sit':50B,90C 'cve':14A,17A 'enabl':48B 'generat':46B,89C 'get':57B 'host':26B 'improp':82C 'input':44B,85C 'issu':108C 'let':7A 'link':64B 'live':36B,103C 'n/a':115C 'neutral':42B,83C 'open':61B 'page':47B,88C 'paid':1A,22B,29B,97C,110C 'paid-videochat':21B 'plugin':33B 'ppv':35B,102C 'ppv-live-webcam':34B,101C 'reflect':5A,49B,106C 'run':9A,66B 'script':10A,53B,67B,93C 'self':25B 'self-host':24B 'session':71B,75B 'site':4A,32B,52B,92C,100C,113C 'steal':74B 'turnkey':3A,31B,99C,112C 'user':43B,81B 'victim':59B 'videochat':2A,23B,30B,98C,111C 'videowhisp':39B 'videowhisper.com':96C 'visitor':12A 'vulner':94C 'web':87C 'webcam':37B,104C 'wordpress':27B 'xss':6A 'xss.this':107C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Paid Videochat Turnkey Site (ppv-live-webcams) plugin at version 7.5.14 or earlier are affected. Sites without this plugin can skip it. The sources do not describe which page or parameter is reflected or whether authentication is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111840","severity":null,"published_at":"2026-10-21T15:17:15+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111840","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111840","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}