Foliovision
Monthly
PHP object injection in FV Flowplayer Video Player 8.3.4 and earlier allows an authenticated WordPress user with the WooCommerce Shop manager role to supply a crafted serialized object to a plugin input that reaches PHP deserialization. Successful object injection can produce high confidentiality, integrity, and availability impact per the CVSS vector, but realized code execution is conditional on a usable POP gadget chain being present in the plugin, WordPress core, or another installed component. The flaw is not anonymously exploitable because it requires the high-privilege Shop manager role, and no public exploit identified at time of analysis.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin, affecting versions up to and including 7.5.55.7212, lets unauthenticated commenters place malicious HTML inside the 'ad', 'popup', or 'end_action_value' attributes of an [fvplayer] or [flowplayer] shortcode, which the plugin later decodes and renders as raw markup. Execution requires the non-default 'Parse Vimeo and YouTube links' option to be enabled, a site administrator to approve the crafted comment, and a visitor to interact with the player on the affected page; the assessed CVSS is 5.4 with AC:H and UI:R. No public exploit was identified at time of analysis, with no CISA KEV entry or confirmed working PoC in the supplied data.
Stored cross-site scripting in the WordPress plugin FV Flowplayer Video Player affects all versions up to and including 7.5.55.7212. An authenticated attacker holding a subscriber-level account or above can submit a profile video whose attribute value is rendered as raw HTML, so script executes in the browser of any user who later views the injected page. Exploitation requires an administrator to have first enabled the non-default 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting; a fixed commit exists upstream, and SSVC records no known exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) lets unauthenticated attackers submit comments whose shortcode 'align' attribute value is neither sanitized on input nor escaped on output, so script executes in the browsers of visitors who later view the affected page. The flaw is only reachable when an administrator has enabled the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting, which registers do_shortcode on the comment_text filter; that condition is not the default, which is why the CVSS 3.1 score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) carries a high attack-complexity metric despite unauthenticated access. Impact is confined to client-side script execution in visitors' browsers with no availability impact, no public exploit has been identified at time of analysis, and priority is assessed as this month rather than immediate.
FV Player 8 through 8.1.7 permits stored cross-site scripting via the synopsis shortcode attribute, allowing authenticated users with contributor-level access or higher to inject scripts that execute when any visitor views the affected page. Sites that enable the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting are also exposed to unauthenticated injection through comment text because the plugin processes shortcodes in comments. The vendor fixed this in 8.1.8; no public exploit identified at time of analysis and no CISA KEV active exploitation confirmed.
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (FolioVision, all versions up to and including 7.5.54.7212) allows an authenticated attacker holding subscriber-level privileges or higher to inject arbitrary JavaScript through an unquoted popup shortcode attribute, which then executes in the browser of any user who later views the affected author bio/archive page. Exploitation is constrained by two prerequisites: the site must have the non-default profile_videos_enable_bio option enabled, and the attacker must first obtain a low-privileged account, which open registration makes feasible but which sites that disable public registration largely close off. At CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this is a moderate-severity issue; no public exploit code was identified at time of analysis, so it should be handled as a patch-in-normal-cycle item rather than an emergency.
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
Stored Cross-Site Scripting in FV Flowplayer Video Player (all WordPress plugin versions up to and including 7.5.51.7212) allows authenticated contributors to permanently inject arbitrary JavaScript via the unsanitized `align` attribute of the `[video_player]` shortcode. The payload persists in the WordPress database and executes in the browser of every user who subsequently visits any page containing the injected shortcode, enabling session hijacking, credential harvesting, or further site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the stored nature of this XSS amplifies real-world risk relative to reflected variants.
Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
PHP object injection in FV Flowplayer Video Player 8.3.4 and earlier allows an authenticated WordPress user with the WooCommerce Shop manager role to supply a crafted serialized object to a plugin input that reaches PHP deserialization. Successful object injection can produce high confidentiality, integrity, and availability impact per the CVSS vector, but realized code execution is conditional on a usable POP gadget chain being present in the plugin, WordPress core, or another installed component. The flaw is not anonymously exploitable because it requires the high-privilege Shop manager role, and no public exploit identified at time of analysis.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin, affecting versions up to and including 7.5.55.7212, lets unauthenticated commenters place malicious HTML inside the 'ad', 'popup', or 'end_action_value' attributes of an [fvplayer] or [flowplayer] shortcode, which the plugin later decodes and renders as raw markup. Execution requires the non-default 'Parse Vimeo and YouTube links' option to be enabled, a site administrator to approve the crafted comment, and a visitor to interact with the player on the affected page; the assessed CVSS is 5.4 with AC:H and UI:R. No public exploit was identified at time of analysis, with no CISA KEV entry or confirmed working PoC in the supplied data.
Stored cross-site scripting in the WordPress plugin FV Flowplayer Video Player affects all versions up to and including 7.5.55.7212. An authenticated attacker holding a subscriber-level account or above can submit a profile video whose attribute value is rendered as raw HTML, so script executes in the browser of any user who later views the injected page. Exploitation requires an administrator to have first enabled the non-default 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting; a fixed commit exists upstream, and SSVC records no known exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) lets unauthenticated attackers submit comments whose shortcode 'align' attribute value is neither sanitized on input nor escaped on output, so script executes in the browsers of visitors who later view the affected page. The flaw is only reachable when an administrator has enabled the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting, which registers do_shortcode on the comment_text filter; that condition is not the default, which is why the CVSS 3.1 score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) carries a high attack-complexity metric despite unauthenticated access. Impact is confined to client-side script execution in visitors' browsers with no availability impact, no public exploit has been identified at time of analysis, and priority is assessed as this month rather than immediate.
FV Player 8 through 8.1.7 permits stored cross-site scripting via the synopsis shortcode attribute, allowing authenticated users with contributor-level access or higher to inject scripts that execute when any visitor views the affected page. Sites that enable the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting are also exposed to unauthenticated injection through comment text because the plugin processes shortcodes in comments. The vendor fixed this in 8.1.8; no public exploit identified at time of analysis and no CISA KEV active exploitation confirmed.
Stored cross-site scripting in the FolioVision FV Simpler SEO WordPress plugin (versions through 1.9.7) lets a user who already holds a low-privilege account on the site persist malicious script into a plugin-managed input field, which then executes in the browser of a higher-privileged user - typically a logged-in administrator - who views the affected plugin or content page. Patchstack scores it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the S:C scope change indicating the injected script can affect resources beyond the vulnerable component; exploitation is gated on two prerequisites, a valid account (PR:L) and interaction by an authenticated victim (UI:R), so it is not an anonymous drive-by attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the plugin is a niche WordPress SEO extension rather than a widely deployed platform component, which limits practical exposure.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (FolioVision, all versions up to and including 7.5.54.7212) allows an authenticated attacker holding subscriber-level privileges or higher to inject arbitrary JavaScript through an unquoted popup shortcode attribute, which then executes in the browser of any user who later views the affected author bio/archive page. Exploitation is constrained by two prerequisites: the site must have the non-default profile_videos_enable_bio option enabled, and the attacker must first obtain a low-privileged account, which open registration makes feasible but which sites that disable public registration largely close off. At CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this is a moderate-severity issue; no public exploit code was identified at time of analysis, so it should be handled as a patch-in-normal-cycle item rather than an emergency.
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
Stored Cross-Site Scripting in FV Flowplayer Video Player (all WordPress plugin versions up to and including 7.5.51.7212) allows authenticated contributors to permanently inject arbitrary JavaScript via the unsanitized `align` attribute of the `[video_player]` shortcode. The payload persists in the WordPress database and executes in the browser of every user who subsequently visits any page containing the injected shortcode, enabling session hijacking, credential harvesting, or further site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the stored nature of this XSS amplifies real-world risk relative to reflected variants.
Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.