Ppv Live Webcams Vulnerabilities

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 7.4.8. This makes it possible for authenticated attackers, with Custom-level access and above, to delete arbitrary files o...

CVSS:

8.1

Affected:

up to 7.4.8

Fixed in:

7.4.9

Disclosed:

Jun 29, 2026

CVE-2026-57331 on NVD →

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.3.23 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulne...

CVSS:

8.1

Affected:

up to 7.3.23

Fixed in:

7.3.24

Disclosed:

May 28, 2026

CVE-2026-27333 on NVD →

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.3.23. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 7.3.23

Fixed in:

7.3.24

Disclosed:

May 26, 2026

CVE-2026-24590 on NVD →

WordPress Paid Videochat Turnkey Site - HTML5 PPV Live Webcams plugin <= 7.3.20 - Authenticated (Author+) Privilege Escalation vulnerability

CVSS:

7.2

Affected:

up to 7.3.20

Fixed in:

7.3.21

Disclosed:

Mar 9, 2026

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.20. This is due to videowhisper_register_form() function not restricting user roles that can be set during registration. This makes it possible for authenticated...

CVSS:

8.8

Affected:

up to 7.3.20

Fixed in:

7.3.21

Disclosed:

Mar 6, 2026

CVE-2025-8899 on NVD →

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.3.23. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

CVSS:

7.2

Affected:

up to 7.3.23

Fixed in:

7.3.24

Disclosed:

Oct 16, 2025

CVE-2025-62959 on NVD →

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.3.11. This is due to the plugin not using a cryptographically secure token for logging in a user. This makes it possible for unauthenticated attackers to log in as...

CVSS:

9.8

Affected:

up to 7.3.11

Fixed in:

7.3.12

Disclosed:

Apr 10, 2025

CVE-2025-31380 on NVD →

The Paid Videochat Turnkey Site – HTML5 PPV Live Webcams plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 7.2.16. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which...

CVSS:

9.1

Affected:

up to 7.2.16

Fixed in:

7.3.1

Disclosed:

Feb 3, 2025

CVE-2025-22663 on NVD →