Fv Player 8
Monthly
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
FV Player 8 through 8.1.7 permits stored cross-site scripting via the synopsis shortcode attribute, allowing authenticated users with contributor-level access or higher to inject scripts that execute when any visitor views the affected page. Sites that enable the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting are also exposed to unauthenticated injection through comment text because the plugin processes shortcodes in comments. The vendor fixed this in 8.1.8; no public exploit identified at time of analysis and no CISA KEV active exploitation confirmed.
Unauthenticated cross-site scripting in the FV Player 8 WordPress plugin versions 8.1.8 and earlier lets an attacker inject script that executes in a victim's browser when the victim clicks a crafted link or loads a page containing the payload. The plugin must be installed and active, and the victim must interact with the malicious input, while the attacker needs no authentication. No public exploit code has been identified at time of analysis, and the independent assessment considers this a genuine but moderate-priority issue rather than a critical emergency because impact is confined to the victim's browser context with low confidentiality and integrity impact.
Arbitrary file upload in the FV Player 8 WordPress plugin (versions up to and including 8.1.7) allows an authenticated attacker with only subscriber-level access to write attacker-supplied remote file content into the public uploads directory, which can lead to remote code execution if the planted file lands in a web-executable location. The vulnerable path is the new-player-creation flow, which is missing a capability check and invokes check_mimetype(), a function that stores the file before any MIME or extension validation occurs; successfully exploiting this therefore requires winning a race condition between the pre-validation write and the subsequent check, which reduces reliability and may require repeated attempts. Sites that permit open user self-registration effectively expose this to any remote party who can create an account. No public exploit code was identified at time of analysis, and the issue is rated High complexity (AC:H) in our independent assessment versus the vendor vector's AC:L, so exploitation should be treated as feasible but probabilistic rather than trivial.
FV Player 8 through 8.1.7 permits stored cross-site scripting via the synopsis shortcode attribute, allowing authenticated users with contributor-level access or higher to inject scripts that execute when any visitor views the affected page. Sites that enable the non-default 'Parse Vimeo and YouTube links' (parse_comments) setting are also exposed to unauthenticated injection through comment text because the plugin processes shortcodes in comments. The vendor fixed this in 8.1.8; no public exploit identified at time of analysis and no CISA KEV active exploitation confirmed.