PatchTheCVE: videowhisperhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-5937: The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vhttps://patchthecve.com/cve/CVE-2025-5937.htmlhttps://patchthecve.com/cve/CVE-2025-5937.htmlWed, 17 Jun 2026 09:49:04 +0000MEDIUM 4.3: The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possibCVE-2025-48255: Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streamihttps://patchthecve.com/cve/CVE-2025-48255.htmlhttps://patchthecve.com/cve/CVE-2025-48255.htmlWed, 17 Jun 2026 09:29:21 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.CVE-2024-12504: The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable https://patchthecve.com/cve/CVE-2024-12504.htmlhttps://patchthecve.com/cve/CVE-2024-12504.htmlWed, 17 Jun 2026 06:59:50 +0000MEDIUM 6.4: The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_hls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping on user suCVE-2024-13584: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Crohttps://patchthecve.com/cve/CVE-2024-13584.htmlhttps://patchthecve.com/cve/CVE-2024-13584.htmlWed, 17 Jun 2026 07:02:18 +0000MEDIUM 6.4: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied CVE-2023-25699: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Vihttps://patchthecve.com/cve/CVE-2023-25699.htmlhttps://patchthecve.com/cve/CVE-2023-25699.htmlWed, 17 Jun 2026 05:41:45 +0000CRITICAL 9.0: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in VideoWhisper.Com VideoWhisper Live Streaming Integration allows OS Command Injection.This issue affects VideoWhisper Live Streaming Integration: from n/a through 5.5.15.