# CVE-2026-111840: VideoWhisper Paid Videochat Turnkey Site reflected XSS in ppv-live-webcams

Source: https://junglewise.ai/threats/cve-2026-111840-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-111840 · Severity: high · CVSS 7.1 · Published 2026-10-21

A WordPress plugin that powers paid video chat functionality contains a reflected cross-site scripting (XSS) vulnerability. Attackers can craft malicious URLs that, when clicked by site visitors, steal their session data or hijack their accounts. The flaw affects all versions through 7.5.14.

Vendors: [VideoWhisper.Com](https://junglewise.ai/threats/vendors/videowhisper-com).

## Quick answers

**Is CVE-2026-111840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111840 being exploited in the wild.

**How severe is CVE-2026-111840?** High severity, with a CVSS score of 7.1, published 21 October 2026.

**Which products and versions are affected?** VideoWhisper.Com Paid Videochat Turnkey Site through 7.5.14.

**Is there a fix for CVE-2026-111840?** Yes: fixed in 7.5.15. Until then: Update to version 7.5.15 or later immediately. If unable to update, use WAF or security plugin rules (such as Patchstack) to block XSS attack patterns until patching is complete. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111840 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111840?** Check whether you run VideoWhisper.Com Paid Videochat Turnkey Site at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.5.15

Update to version 7.5.15 or later immediately. If unable to update, use WAF or security plugin rules (such as Patchstack) to block XSS attack patterns until patching is complete.

## Technical details

The ppv-live-webcams plugin fails to properly sanitize user input before outputting it to web pages, allowing reflected XSS injection. An unauthenticated attacker can craft a malicious URL containing JavaScript that executes in the visitor's browser. This requires user interaction (clicking a link) but can be used in mass-exploit campaigns targeting WordPress installations.

## Affected products

- VideoWhisper.com Paid Videochat Turnkey Site through 7.5.14

## Timeline

- 2026-10-15: disclosed
- 2026-10-19: advisory
- 2026-10-21: other: Published to NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ppv-live-webcams/vulnerability/wordpress-paid-videochat-turnkey-site-plugin-7-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [VideoWhisper Paid Videochat Turnkey Site input validation weakness](https://junglewise.ai/threats/cve-2026-107429-improper-validation-of-specified-quantity-in-input-vulnerability)