CVE-2026-24937: WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-25 · updated 2026-07-24
Weakness: CWE-94

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.

Affected products

VideoWhisper.com Broadcast Live Video: before 7.1.3 — fixed in 7.1.3

How to fix

Upgrade to a fixed version: VideoWhisper.com Broadcast Live Video 7.1.3. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-1-3-remote-code-execution-rce-vulnerability?_s_id=cve

Get alerted when CVE-2026-24937 or the next vulnerability affects your stack