Paid Videochat Turnkey Site: Reflected cross-site scripting (XSS)

Summary

The WordPress plugin Paid Videochat Turnkey Site (ppv-live-webcams) contains a reflected cross-site scripting flaw (CWE-79). An attacker can inject malicious scripts that run in the browser of a visitor or logged-in user, for example to steal data or hijack accounts. Exploitation requires that a victim clicks a crafted link or visits a crafted page. The CNA rates the issue CVSS 7.1 (High), while VulDB rates it lower.

Affected

• Paid Videochat Turnkey Site WordPress plugin up to and including 7.5.14
• Versions before 7.5.15 are considered affected per the CVE record; exact range from n/a

Fixed in

• Version 7.5.15 or later (per the CNA and Patchstack)

Workaround

• Unknown. No vendor-documented workaround for versions 7.5.14 and earlier.
• Patchstack reports a mitigation rule that blocks attacks until the plugin is updated, if you are a Patchstack customer.

Exploitation

• CISA SSVC: exploitation none, not automatable, partial technical impact.
• Patchstack describes the issue as medium priority and expects exploitation.
• No public proof of concept found in research; this does not prove none exists.

Our recommendation

• Check all WordPress installations for this plugin and its version.
• Update the plugin to version 7.5.15 or later.
• If an update is not possible right away, ask your hosting provider or web developer for help or temporarily deactivate the plugin.
• Review other VideoWhisper plugin components on the same site.
• Monitor logs for suspicious requests with script content.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: Vulnerability entry CVE-2026-111840 patchstack.com
• OpenCVE: CVE-2026-111840 app.opencve.io
• WPScan: Paid Videochat Turnkey Site plugin wpscan.com
• WordPress.org: Paid Videochat Turnkey Site plugin wordpress.org
• Strix AI: CVE-2026-111840 www.strix.ai
• VulDB: Entry 424839 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 09:46.