# cve.now: Videowhisper

The newest entries naming Videowhisper as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107434](https://cve.now/CVE-2026-107434.md): WordPress MicroPayments plugin \<= 3.2.9 - Bypass Vulnerability vulnerability (CVSS 5.4)
- [CVE-2026-57716](https://cve.now/CVE-2026-57716.md): WordPress Broadcast Live Video plugin \<= 7.2.4 - Arbitrary File Deletion vulnerability (CVSS 5.3)
- [CVE-2026-57696](https://cve.now/CVE-2026-57696.md): WordPress Picture Gallery plugin \<= 1.6.5 - Arbitrary File Deletion vulnerability (CVSS 7.1)
- [CVE-2026-57331](https://cve.now/CVE-2026-57331.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.4.8 - Arbitrary File Deletion vulnerability (CVSS 9.9)
- [CVE-2026-4301](https://cve.now/CVE-2026-4301.md): Rate Star Review Vote \<= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating\_id' Parameter (CVSS 4.3)
- [CVE-2025-8899](https://cve.now/CVE-2025-8899.md): Paid Videochat Turnkey Site – HTML5 PPV Live Webcams \<= 7.3.20 - Authenticated (Author+) Privilege Escalation (CVSS 8.8)
- [CVE-2025-13727](https://cve.now/CVE-2025-13727.md): Video Share VOD \<= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values (CVSS 4.4)
- [CVE-2025-62959](https://cve.now/CVE-2025-62959.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.3.23 - Remote Code Execution (RCE) vulnerability (CVSS 9.1)
- [CVE-2025-7812](https://cve.now/CVE-2025-7812.md): Video Share VOD – Turnkey Video Site Builder Script \<= 2.7.6 - Cross-Site Request Forgery to Command Injection (CVSS 8.8)
- [CVE-2025-5937](https://cve.now/CVE-2025-5937.md): MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet \<= 3.2.0 - Cross-Site Request Forgery to Settings Reset (CVSS 4.3)
- [CVE-2025-48255](https://cve.now/CVE-2025-48255.md): WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin \<= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-31380](https://cve.now/CVE-2025-31380.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.3.11 - Broken Authentication Vulnerability (CVSS 9.8)
- [CVE-2025-31075](https://cve.now/CVE-2025-31075.md): WordPress MicroPayments plugin \<= 2.9.29 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-26583](https://cve.now/CVE-2025-26583.md): WordPress Video Share VOD plugin \<= 2.7.9 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1)
- [CVE-2025-26581](https://cve.now/CVE-2025-26581.md): WordPress Picture Gallery plugin \<= 1.6.3 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2025-26579](https://cve.now/CVE-2025-26579.md): WordPress MicroPayments Paid Membership plugin \<= 3.2.4 - Reflected Cross-Site Scripting vulnerability (CVSS 7.1)
- [CVE-2025-26753](https://cve.now/CVE-2025-26753.md): WordPress VideoWhisper Live Streaming Integration plugin \<= 6.2 - Arbitrary File Download vulnerability (CVSS 7.5)
- [CVE-2025-26752](https://cve.now/CVE-2025-26752.md): WordPress VideoWhisper Live Streaming Integration plugin \<= 6.2 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2025-22663](https://cve.now/CVE-2025-22663.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.2.12 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2024-12504](https://cve.now/CVE-2024-12504.md): Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP \<= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13584](https://cve.now/CVE-2024-13584.md): Picture Gallery – Frontend Image Uploads, AJAX Photo List \<= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13392](https://cve.now/CVE-2024-13392.md): Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings \<= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-13393](https://cve.now/CVE-2024-13393.md): Video Share VOD – Turnkey Video Site Builder Script \<= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12696](https://cve.now/CVE-2024-12696.md): Picture Gallery – Frontend Image Uploads, AJAX Photo List \<= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper\_picture\_upload\_guest Shortcode (CVSS 6.4)
- [CVE-2024-13391](https://cve.now/CVE-2024-13391.md): MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet \<= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12449](https://cve.now/CVE-2024-12449.md): Video Share VOD – Turnkey Video Site Builder Script \<= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-49235](https://cve.now/CVE-2024-49235.md): WordPress Contact Forms, Live Support, CRM, Video Messages plugin \<= 1.10.2 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2024-34759](https://cve.now/CVE-2024-34759.md): WordPress Picture Gallery plugin \<= 1.5.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-52213](https://cve.now/CVE-2023-52213.md): WordPress Rate Star Review Plugin \<= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-27629](https://cve.now/CVE-2022-27629.md): Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prio (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/videowhisper
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.