Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Broadcast Live Video plugin lets attackers hijack user sessions

CVE-2026-107421 · published 21 days ago
Summary

The Broadcast Live Video plugin for WordPress can let a malicious site take over a user’s logged‑in session. This means an attacker could act as the victim on your site, posting or changing content without permission. Update the plugin beyond version 7.3.2 or remove it until a safe version is available.

What to do
  • Update videowhisper.com broadcast live video to version 7.3.3.
Affected software
VendorProductAffected versions
videowhisper.com broadcast live video <= 7.3.2
Fix: upgrade to 7.3.3
Original advisory text
WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-107421 · NVD
CVE-2026-107421 · MITRE
Track software like this
Free during beta