Skip to content
OpenAdvisories

Vendor

videowhisper

30 known vulnerabilities.

Products

Video Share VOD – Turnkey Video Site Builder Script 4 Broadcast Live Video 4 Paid Videochat Turnkey Site 4 Picture Gallery 3 MicroPayments 3 Picture Gallery – Frontend Image Uploads, AJAX Photo List 2 MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet 2 Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings 2 Video Share VOD 1 Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP 1 MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership 1 Paid Videochat Turnkey Site – HTML5 PPV Live Webcams 1 Rate Star Review – AJAX Reviews for Content, with Star Ratings 1 Contact Forms, Live Support, CRM, Video Messages 1
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-107434

    WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability

    Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

    videowhisper MicroPayments
  • Medium 5.3
    CVE-2026-57716

    WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

    videowhisper Broadcast Live Video
  • Medium 4.3
    CVE-2026-4301

    Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter

    The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. The vwrsr_review() AJAX handler lacks both capability checks and nonce verification. The only …

    videowhisper Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings Web / CMS
  • Medium 4.4
    CVE-2025-13727

    Video Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values

    The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes i…

    videowhisper Video Share VOD – Turnkey Video Site Builder Script Web / CMS
  • Medium 4.3
    CVE-2025-5937

    MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset

    The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the admi…

    videowhisper MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Web / CMS
  • Medium 4.3
    CVE-2025-48255

    WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin <= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.

    videowhisper Broadcast Live Video
  • Medium 6.5
    CVE-2025-31075

    WordPress MicroPayments plugin <= 2.9.29 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through <= 2.9.29.

    videowhisper MicroPayments
  • Medium 6.4
    CVE-2024-12504

    Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_hls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sa…

    videowhisper Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP Web / CMS
  • Medium 6.4
    CVE-2024-13584

    Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitizat…

    videowhisper Picture Gallery – Frontend Image Uploads, AJAX Photo List Web / CMS
  • Medium 6.4
    CVE-2024-13392

    Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitizatio…

    videowhisper Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings Web / CMS
  • Medium 6.4
    CVE-2024-13393

    Video Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_videos' shortcode in all versions up to, and including, 2.6.31 due to insufficient input sanitization and …

    videowhisper Video Share VOD – Turnkey Video Site Builder Script Web / CMS
  • Medium 6.4
    CVE-2024-12696

    Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode

    The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input…

    videowhisper Picture Gallery – Frontend Image Uploads, AJAX Photo List Web / CMS
  • Medium 6.4
    CVE-2024-13391

    MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, …

    videowhisper MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Web / CMS
  • Medium 6.4
    CVE-2024-12449

    Video Share VOD – Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization…

    videowhisper Video Share VOD – Turnkey Video Site Builder Script Web / CMS
  • Medium 6.5
    CVE-2024-34759

    WordPress Picture Gallery plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VideoWhisper Picture Gallery allows Stored XSS.This issue affects Picture Gallery: from n/a through 1.5.11.

    videowhisper Picture Gallery