{"id":"CVE-2026-122664","kind":"vulnerability","aliases":["CVE-2026-122664"],"related":[],"title":"WordPress Broadcast Live Video plugin: reflected XSS through version 7.3.14","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through 7.3.14.","summary":"The Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can run scripts in a visitor's browser by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"videowhisper-live-streaming-integration","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","videowhisper","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `videowhisper-live-streaming-integration` plugin is installed and its version in the WordPress admin plugin list\n- Confirm the installed version is above `7.3.14` to be outside the reported range","fix":"- Broadcast Live Video (videowhisper-live-streaming-integration): unknown, the sources give no fixed version","status":"open","published_at":"2026-11-09T17:17:26+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","triaged_at":"2026-11-09T17:28:57+00:00","updated_at":"2026-11-09T17:28:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T17:28:57Z","model":"claude-haiku-5-5","output":{"fix":"- Broadcast Live Video (videowhisper-live-streaming-integration): unknown, the sources give no fixed version","reach":"internet","title":"WordPress Broadcast Live Video plugin: reflected XSS through version 7.3.14","impact":"medium","summary":"The Broadcast Live Video WordPress plugin (videowhisper-live-streaming-integration) does not neutralize input in generated pages, enabling reflected cross-site scripting. An attacker can run scripts in a visitor's browser by tricking them into opening a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","videowhisper","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in a visitor's browser on the site","analyst_note":"Find the fixed version and the vulnerable parameter in the NVD entry or the plugin changelog; sources give only the range through 7.3.14.","how_to_check":"- Check whether the `videowhisper-live-streaming-integration` plugin is installed and its version in the WordPress admin plugin list\n- Confirm the installed version is above `7.3.14` to be outside the reported range","plain_action":"","product_name":"videowhisper-live-streaming-integration","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Broadcast Live Video WordPress plugin at version 7.3.14 or older are in the reported range. Exposure depends on the page path the plugin renders with user input; sites without the plugin are not affected. The sources do not say whether a default configuration is required.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000768,"input_tokens":4559,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122664':13A,16A '-2026':12A,15A '7.3.14':10A,104C 'affect':97C 'allow':93C 'attack':53B 'broadcast':2A,29B,85C,98C 'browser':61B 'craft':68B 'cross':49B,79C 'cross-sit':48B,78C 'cve':11A,14A 'enabl':46B 'generat':44B,77C 'host':25B 'improp':70C 'input':42B,73C 'integr':38B,92C 'integration':21A 'issu':96C 'link':69B 'live':3A,19A,30B,36B,86C,90C,99C 'n/a':102C 'neutral':41B,71C 'open':66B 'packag':22B 'page':45B,76C 'plugin':5A,33B 'reflect':6A,47B,94C 'run':55B 'script':51B,56B,81C 'self':24B 'self-host':23B 'site':50B,80C 'stream':37B,91C 'streaming':20A 'trick':63B 'version':9A 'video':4A,31B,87C,100C 'videowhisp':26B,35B,89C 'videowhisper':18A 'videowhisper-live-streaming-integr':34B,88C 'videowhisper-live-streaming-integration':17A 'videowhisper.com':84C 'visitor':59B 'vulner':82C 'web':75C 'wordpress':1A,27B,32B 'xss':7A 'xss.this':95C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Broadcast Live Video WordPress plugin at version 7.3.14 or older are in the reported range. Exposure depends on the page path the plugin renders with user input; sites without the plugin are not affected. The sources do not say whether a default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["videowhisperlivestreamingintegration"],"ptokens":["integration","live","streaming","videowhisper"],"labels":["high","package","selfhosted","vendor","videowhisper","wordpress"],"campaign_type":null,"search_a":"'-122664':13A,16A '-2026':12A,15A '7.3.14':10A 'broadcast':2A 'cve':11A,14A 'integration':21A 'live':3A,19A 'plugin':5A 'reflect':6A 'streaming':20A 'version':9A 'video':4A 'videowhisper':18A 'videowhisper-live-streaming-integration':17A 'wordpress':1A 'xss':7A","search_b":"'attack':53B 'broadcast':29B 'browser':61B 'craft':68B 'cross':49B 'cross-sit':48B 'enabl':46B 'generat':44B 'host':25B 'input':42B 'integr':38B 'link':69B 'live':30B,36B 'neutral':41B 'open':66B 'packag':22B 'page':45B 'plugin':33B 'reflect':47B 'run':55B 'script':51B,56B 'self':24B 'self-host':23B 'site':50B 'stream':37B 'trick':63B 'video':31B 'videowhisp':26B,35B 'videowhisper-live-streaming-integr':34B 'visitor':59B 'wordpress':27B,32B","search_c":"'7.3.14':104C 'affect':97C 'allow':93C 'broadcast':85C,98C 'cross':79C 'cross-sit':78C 'generat':77C 'improp':70C 'input':73C 'integr':92C 'issu':96C 'live':86C,90C,99C 'n/a':102C 'neutral':71C 'page':76C 'reflect':94C 'script':81C 'site':80C 'stream':91C 'video':87C,100C 'videowhisp':89C 'videowhisper-live-streaming-integr':88C 'videowhisper.com':84C 'vulner':82C 'web':75C 'xss.this':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122664","severity":null,"published_at":"2026-11-09T17:17:26+00:00","modified_at":"2026-11-09T17:17:26+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","fetched_at":"2026-11-09T17:27:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}