Fv Flowplayer Video Player
Monthly
PHP object injection in FV Flowplayer Video Player 8.3.4 and earlier allows an authenticated WordPress user with the WooCommerce Shop manager role to supply a crafted serialized object to a plugin input that reaches PHP deserialization. Successful object injection can produce high confidentiality, integrity, and availability impact per the CVSS vector, but realized code execution is conditional on a usable POP gadget chain being present in the plugin, WordPress core, or another installed component. The flaw is not anonymously exploitable because it requires the high-privilege Shop manager role, and no public exploit identified at time of analysis.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin, affecting versions up to and including 7.5.55.7212, lets unauthenticated commenters place malicious HTML inside the 'ad', 'popup', or 'end_action_value' attributes of an [fvplayer] or [flowplayer] shortcode, which the plugin later decodes and renders as raw markup. Execution requires the non-default 'Parse Vimeo and YouTube links' option to be enabled, a site administrator to approve the crafted comment, and a visitor to interact with the player on the affected page; the assessed CVSS is 5.4 with AC:H and UI:R. No public exploit was identified at time of analysis, with no CISA KEV entry or confirmed working PoC in the supplied data.
Stored cross-site scripting in the WordPress plugin FV Flowplayer Video Player affects all versions up to and including 7.5.55.7212. An authenticated attacker holding a subscriber-level account or above can submit a profile video whose attribute value is rendered as raw HTML, so script executes in the browser of any user who later views the injected page. Exploitation requires an administrator to have first enabled the non-default 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting; a fixed commit exists upstream, and SSVC records no known exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) lets unauthenticated attackers submit comments whose shortcode 'align' attribute value is neither sanitized on input nor escaped on output, so script executes in the browsers of visitors who later view the affected page. The flaw is only reachable when an administrator has enabled the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting, which registers do_shortcode on the comment_text filter; that condition is not the default, which is why the CVSS 3.1 score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) carries a high attack-complexity metric despite unauthenticated access. Impact is confined to client-side script execution in visitors' browsers with no availability impact, no public exploit has been identified at time of analysis, and priority is assessed as this month rather than immediate.
Contributor-level WordPress users can abuse the FV Flowplayer Video Player plugin's server-side URL fetch routine to probe internal network resources, because the plugin fails to properly validate a user-supplied URL and its existing host-based restriction does not cover every case. Only sites running versions 7.5.44.7212 through 7.5.55.7212 that grant untrusted users Contributor access or above are realistically exposed, and the payoff is a semi-blind oracle: the attacker learns whether an internal host or service responds and its HTTP status code, but never sees the response body, making this a reconnaissance primitive rather than a data-theft vector. Exploitation is authenticated and requires the plugin's URL-based media fetch feature, EPSS is a negligible 0.16 percent (5th percentile), SSVC records no observed exploitation and no automatable path, and while publicly available exploit code exists there is no evidence of active exploitation in the wild; the vendor has shipped a patch in 7.5.55.7212, and this remains a genuinely low-priority issue.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (FolioVision, all versions up to and including 7.5.54.7212) allows an authenticated attacker holding subscriber-level privileges or higher to inject arbitrary JavaScript through an unquoted popup shortcode attribute, which then executes in the browser of any user who later views the affected author bio/archive page. Exploitation is constrained by two prerequisites: the site must have the non-default profile_videos_enable_bio option enabled, and the attacker must first obtain a low-privileged account, which open registration makes feasible but which sites that disable public registration largely close off. At CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this is a moderate-severity issue; no public exploit code was identified at time of analysis, so it should be handled as a patch-in-normal-cycle item rather than an emergency.
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
Stored Cross-Site Scripting in FV Flowplayer Video Player (all WordPress plugin versions up to and including 7.5.51.7212) allows authenticated contributors to permanently inject arbitrary JavaScript via the unsanitized `align` attribute of the `[video_player]` shortcode. The payload persists in the WordPress database and executes in the browser of every user who subsequently visits any page containing the injected shortcode, enabling session hijacking, credential harvesting, or further site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the stored nature of this XSS amplifies real-world risk relative to reflected variants.
Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP object injection in FV Flowplayer Video Player 8.3.4 and earlier allows an authenticated WordPress user with the WooCommerce Shop manager role to supply a crafted serialized object to a plugin input that reaches PHP deserialization. Successful object injection can produce high confidentiality, integrity, and availability impact per the CVSS vector, but realized code execution is conditional on a usable POP gadget chain being present in the plugin, WordPress core, or another installed component. The flaw is not anonymously exploitable because it requires the high-privilege Shop manager role, and no public exploit identified at time of analysis.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin, affecting versions up to and including 7.5.55.7212, lets unauthenticated commenters place malicious HTML inside the 'ad', 'popup', or 'end_action_value' attributes of an [fvplayer] or [flowplayer] shortcode, which the plugin later decodes and renders as raw markup. Execution requires the non-default 'Parse Vimeo and YouTube links' option to be enabled, a site administrator to approve the crafted comment, and a visitor to interact with the player on the affected page; the assessed CVSS is 5.4 with AC:H and UI:R. No public exploit was identified at time of analysis, with no CISA KEV entry or confirmed working PoC in the supplied data.
Stored cross-site scripting in the WordPress plugin FV Flowplayer Video Player affects all versions up to and including 7.5.55.7212. An authenticated attacker holding a subscriber-level account or above can submit a profile video whose attribute value is rendered as raw HTML, so script executes in the browser of any user who later views the injected page. Exploitation requires an administrator to have first enabled the non-default 'Allow visitors to upload videos to their profile' (profile_videos_enable_bio) setting; a fixed commit exists upstream, and SSVC records no known exploitation and no public exploit identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) lets unauthenticated attackers submit comments whose shortcode 'align' attribute value is neither sanitized on input nor escaped on output, so script executes in the browsers of visitors who later view the affected page. The flaw is only reachable when an administrator has enabled the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting, which registers do_shortcode on the comment_text filter; that condition is not the default, which is why the CVSS 3.1 score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) carries a high attack-complexity metric despite unauthenticated access. Impact is confined to client-side script execution in visitors' browsers with no availability impact, no public exploit has been identified at time of analysis, and priority is assessed as this month rather than immediate.
Contributor-level WordPress users can abuse the FV Flowplayer Video Player plugin's server-side URL fetch routine to probe internal network resources, because the plugin fails to properly validate a user-supplied URL and its existing host-based restriction does not cover every case. Only sites running versions 7.5.44.7212 through 7.5.55.7212 that grant untrusted users Contributor access or above are realistically exposed, and the payoff is a semi-blind oracle: the attacker learns whether an internal host or service responds and its HTTP status code, but never sees the response body, making this a reconnaissance primitive rather than a data-theft vector. Exploitation is authenticated and requires the plugin's URL-based media fetch feature, EPSS is a negligible 0.16 percent (5th percentile), SSVC records no observed exploitation and no automatable path, and while publicly available exploit code exists there is no evidence of active exploitation in the wild; the vendor has shipped a patch in 7.5.55.7212, and this remains a genuinely low-priority issue.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (FolioVision, all versions up to and including 7.5.54.7212) allows an authenticated attacker holding subscriber-level privileges or higher to inject arbitrary JavaScript through an unquoted popup shortcode attribute, which then executes in the browser of any user who later views the affected author bio/archive page. Exploitation is constrained by two prerequisites: the site must have the non-default profile_videos_enable_bio option enabled, and the attacker must first obtain a low-privileged account, which open registration makes feasible but which sites that disable public registration largely close off. At CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) this is a moderate-severity issue; no public exploit code was identified at time of analysis, so it should be handled as a patch-in-normal-cycle item rather than an emergency.
Stored cross-site scripting (XSS) in the FolioVision FV Flowplayer Video Player plugin for WordPress, affecting all versions through 7.5.54.7212, lets an attacker with sufficient privileges to store content in the plugin (CVSS PR:L) inject JavaScript that later executes in the browser of a second user - typically an administrator or editor - who views the affected page or admin view (CVSS UI:R). Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, CWE-79), impact is confined to the victim's browser session rather than direct server compromise, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. The report originates from Patchstack and the exact input field serving as the injection vector is not specified in the available advisory.
Stored Cross-Site Scripting in FV Flowplayer Video Player (all WordPress plugin versions up to and including 7.5.51.7212) allows authenticated contributors to permanently inject arbitrary JavaScript via the unsanitized `align` attribute of the `[video_player]` shortcode. The payload persists in the WordPress database and executes in the browser of every user who subsequently visits any page containing the injected shortcode, enabling session hijacking, credential harvesting, or further site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the stored nature of this XSS amplifies real-world risk relative to reflected variants.
Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.