WpStream – Live Streaming, Video on Demand, Pay Per View

WpStream – Live Streaming, Video on Demand, Pay Per View has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (33%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.

Every one of the 6 issues recorded for WpStream – Live Streaming, Video on Demand, Pay Per View has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by Muhammad Sharief (Md Sharief). WpStream – Live Streaming, Video on Demand, Pay Per View is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.2/ 10
Patch Coverage100%
Open

0

Fixed

6

Get automatic notifications for all WpStream – Live Streaming, Video on Demand, Pay Per View vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-39527

WpStream – Live Streaming, Video on Demand, Pay Per View < 4.11.2 - Authenticated (Subscriber+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

6 records
WpStream – Live Streaming, Video on Demand, Pay Per View banner
Latestv4.14.1

WpStream – Live Streaming, Video on Demand, Pay Per View

wpstream

Author

wpstream

4.8(78)
96/100
Last Updated
2026-09-10 (3d ago)
Active Installs
3,000+
Downloads
456,151
Requires WP
5.8+
Requires PHP
7.1+
Tested up to
WP 7.0.4
Created
2017-12-18 (9y ago)

Live stream on your WordPress website and make recordings available for replay. WpStream lets you broadcast from your browser or streaming software such as OBS, with viewers watching on your own site. Add live services, shows, matches, classes, or events to the website you already manage. Offer free viewing or sell access through WooCommerce. WpStream handles video delivery through its streaming service. Your WordPress site hosts the pages and viewing experience; it does not have to serve the live video traffic from your web hosting account. Free plugin, separate streaming service The WpStream plugin is free to install. To use WpStream’s live streaming and cloud video services, connect a WpStream account. A free trial is available to test the service; paid streaming plans are separate from the plugin. Plans have allowances for broadcasting, viewing, and recording storage. Free-to-view means your audience does not pay to watch; it does not mean the streaming service is free. See the current plans and resource allowances before choosing a plan. WooCommerce is optional for free-to-view broadcasts. Pay-per-view requires WooCommerce. The documented recurring-subscription setup also requires the separately purchased WooCommerce Subscriptions extension. Broadcast from your browser or streaming software Go live on your website using your browser and webcam, or connect an external encoder that supports a custom RTMP destination, such as OBS Studio, Wirecast, or Larix. For a basic webcam broadcast on an existing WordPress site, setup can take three minutes or less. Allow extra time for payment setup, custom page layouts, or configuring an external encoder. Create a live channel, choose your broadcast method, and share the channel page with your audience. You can also place the player inside an existing page. Record live streams and publish replays Record a live broadcast or upload a video file, then publish it as video on demand. Give viewers a place to catch up on a missed service, watch a previous match, or revisit a class. Offer recordings free to watch, sell individual videos, or include them in a subscription with the required WooCommerce setup. Sell access with WooCommerce when you need it Sell access to live streams and recorded videos through your WordPress site’s WooCommerce checkout. Pay-per-view: sell access to an individual live stream or video with WooCommerce. Subscriptions: offer recurring access with WooCommerce and WooCommerce Subscriptions. See the subscription setup guide. Free viewing: publish broadcasts and videos without asking viewers to purchase access. Choose your branding and viewing access Add your own logo to the player and choose how live streams and videos appear on your site. For private events, you can use a password-protected viewing page. For paid access, use the WooCommerce options above. Read more about WpStream’s approach to content rights. Add players and video lists to your pages Each live channel and on-demand video has its own page. To place a player elsewhere, use the WpStream Player block, Elementor or WPBakery element, or shortcode. Use channel and video lists to help viewers find current broadcasts and available recordings. See the player and listing documentation. Let approved users broadcast without admin access If other people broadcast on your site, configure which non-admin user roles are allowed to stream. Add the front-end broadcasting controls to their pages so they can start a broadcast without access to the WordPress admin dashboard. See the front-end broadcasting documentation for setup. Optional: Hello WpStream theme You do not need to switch to Hello WpStream to use the plugin. If you are building a new video website, the Hello WpStream theme provides a starting point designed for WpStream. Getting started and support Use the getting-started documentation and video tutorials to set up your first broadcast. For questions or troubleshooting, visit the plugin support forum. CONNECT WITH US YouTube Facebook Twitter LinkedIn

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C