Reflected Cross-Site Scripting in VideoWhisper Paid Videochat Turnkey Site

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the VideoWhisper.com Paid Videochat Turnkey Site plugin for WordPress. It allows attackers to inject malicious scripts into web pages by exploiting improper input neutralization during page generation. The vulnerability exists in versions 7.5.12 and below.

Useful 0 Not Useful 0

Detection Guidance

Detecting this XSS vulnerability typically involves checking for outdated versions of the VideoWhisper Paid Videochat Turnkey Site plugin. Use WordPress admin to verify the plugin version or inspect files for version details in the plugin directory. Network-level detection may involve monitoring for unusual script injections in web traffic.

Useful 0 Not Useful 0

Impact Analysis

Attackers could steal visitor data, hijack user accounts, or perform actions on behalf of users. Exploitation requires user interaction like clicking a malicious link. It is often used in mass-exploit campaigns targeting many websites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, including sensitive information like personal details or session tokens, which may violate GDPR and HIPAA compliance requirements for data protection and privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the VideoWhisper Paid Videochat Turnkey Site plugin to version 7.5.13 or later. If updating is not possible, apply Patchstack’s mitigation rules to block attacks until the update is applied. Remove any suspicious scripts or files from your website.

Useful 0 Not Useful 0