The plugin contains an improper neutralization of input during web‑page generation, enabling reflected cross‑site scripting. An attacker can inject malicious scripts that execute in the browser of any user who views a page processed by the plugin, potentially allowing cookie theft, session hijacking, or defacement.

VideoWhisper.com's WordPress Paid Videochat Turnkey Site plugin, affecting all installations with versions from any initial release through 7.5.14.

The recorded CVSS score of 7.1 indicates a high severity level. EPSS data is not available, so the likelihood of exploitation cannot be quantified at this time, and the vulnerability is not yet listed in CISA’s KEV catalog. Based on the described mitigation, the attack vector is remote and relies on a crafted request that includes unsanitized user‑supplied data, so a social‑engineering or phishing campaign could be used to deliver the exploit.