Wpstream Vulnerabilities

The WpStream – Live Streaming, Video on Demand, Pay Per View plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to 4.11.2 (exclusive). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on...

CVSS:

8.8

Affected:

up to 4.11.2

Fixed in:

4.11.2

Disclosed:

Apr 17, 2026

CVE-2026-39527 on NVD →

The WpStream – Live Streaming, Video on Demand, Pay Per View plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 4.11.2 (exclusive) due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVSS:

4.3

Affected:

up to 4.11.2

Fixed in:

4.11.2

Disclosed:

Mar 11, 2026

CVE-2026-39526 on NVD →

The WpStream – Live Streaming, Video on Demand, Pay Per View plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an un...

CVSS:

4.3

Affected:

up to 4.9.5

Fixed in:

4.9.6

Disclosed:

Dec 30, 2025

CVE-2025-68522 on NVD →

The WpStream – Live Streaming, Video on Demand, Pay Per View plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.9.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.9.5

Fixed in:

4.9.6

Disclosed:

Dec 29, 2025

CVE-2025-68521 on NVD →

[en] Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

Affected:

up to 4.9.5

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68522 on NVD →

[en] Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

Affected:

up to 4.9.5

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68521 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream plugin <= 4.4.10 versions.

Affected:

up to 4.5.5

Fixed in:

4.5.5

Disclosed:

Nov 22, 2023

CVE-2023-27458 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Wpstream WpStream – Live Streaming, Video on Demand, Pay Per View plugin <= 4.5.4 versions.

Affected:

up to 4.5.5

Fixed in:

4.5.5

Disclosed:

Jul 27, 2023

CVE-2023-38512 on NVD →

The WpStream – Live Streaming, Video on Demand, Pay Per View plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.4. This is due to missing or incorrect nonce validation on the wpstream_update_local_event_settings function. This makes it possible for unauthenticated att...

CVSS:

4.3

Affected:

up to 4.5.4

Fixed in:

4.5.5

Disclosed:

Jul 20, 2023

CVE-2023-38512 on NVD →

The WpStream – Live Streaming, Video on Demand, Pay Per View plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.10. This is due to missing or incorrect nonce validation on the 'wpstream_settings' function. This makes it possible for unauthenticated attackers to update...

CVSS:

4.3

Affected:

up to 4.4.10

Fixed in:

4.4.10.6

Disclosed:

Mar 2, 2023

CVE-2023-27458 on NVD →