Technical impact
This vulnerability is a reflected Cross‑Site Scripting (XSS) flaw that occurs when the VideoWhisper.com Paid Videochat Turnkey Site WordPress plugin fails to neutralize user input during web page rendering. A malicious script can be executed in the browser of any user who opens a crafted URL or interacts with a form that the plugin reflects, because the input is displayed without proper escaping. This can allow arbitrary JavaScript to run in the victim’s browser context, potentially affecting the confidentiality, integrity, or availability of the victim’s session data.
Affected Systems
All installations of the Paid Videochat Turnkey Site WordPress plugin with versions through 7.5.12, including earlier releases that lack the fix. These affect WordPress sites that have installed the plugin from VideoWhisper.com.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity impact. The EPSS score is < 1%, indicating a very low likelihood of exploitation in the short term. The vulnerability is not listed in the CISA KEV catalog. Based on common characteristics of reflected XSS, it likely requires the attacker to provide a crafted URL or input that must be visited or submitted by a target user, making it a client‑side exploit that depends on user interaction.
