WordPress VideoWhisper Live Streaming Integration plugin <= 5.5.15 - Remote Code Execution (RCE)
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01289 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VideoWhisper.com | VideoWhisper Live Streaming Integration | up to 5.5.15 | — | No fix listed | CNA |
- VideoWhisper Live Streaming Integration VendorVideoWhisper.com Affected up to 5.5.15 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:videowhisper:videowhisper_live_streaming_integration:*:*:*:*:*:wordpress:*:* | before 5.5.16 | Vulnerable | videowhisper |
- cpe:2.3:a:videowhisper:videowhisper_live_streaming_integration:*:*:*:*:*:wordpress:*:* Versions before 5.5.16 Vulnerable ·videowhisper
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25699
- 2026-10-03 Alias added: GHSA-m586-22m6-88g8
More VideoWhisper.com vulnerabilities
- TI-2026-21516 WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-86525 Missing authorization in 2Way VideoCalls and Random Chat for WordPress CVSS 3.1MEDIUM 5.3
- TI-2026-73977 Missing authorization in Paid Videochat Turnkey Site WordPress plugin CVSS 3.1HIGH 7.3
- TI-2026-73973 Session fixation in Broadcast Live Video WordPress plugin CVSS 3.1HIGH 7.3
- TI-2026-21751 WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability CVSS 3.1HIGH 8.1
- TI-2026-76058 Authentication bypass in 2Way VideoCalls and Random Chat plugin CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-25699 · CVE Program
- CVE-2023-25699 · NVD
- FIRST EPSS
- GHSA-m586-22m6-88g8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences