Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 27

CVE-2026-118079

WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-110001

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting to be enabled by an administrator, which causes the plugin to register do_shortcode on the comment_text filter, allowing attacker-supplied shortcode attributes stored in comments to be rendered unescaped to all subsequent visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-110533

FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-109984

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode; execution is then triggered for any visitor who interacts with the video player on that page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-121515

FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-121764

WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress-extensions
Products
Fv Flowplayer Video Player Fv Flowplayer Video Player
CVE-2026-12135

FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2026-7556

FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled the non-default 'Parse Vimeo and YouTube links' (parse_comments) plugin setting, and requires a submitted comment to be approved by an administrator before the payload is publicly delivered.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2024-32955

WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2024-32078

WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2024-29122

WordPress FV Player plugin <= 7.5.41.7212 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2024-22299

WordPress FV Player plugin <= 7.5.41.7212 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2022-25613

WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player
CVE-2024-35631

WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Foliovision Wordpress
Products
Fv Flowplayer Video Player Wordpress
CVE-2023-4520

FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and including, 7.5.37.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, and makes it possible to update the user metas arbitrarily, but the meta value can only be a string.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player
CVE-2024-6338

FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player
CVE-2022-25607

WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability

Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player
CVE-2021-39350

FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting

The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player
CVE-2023-25066

WordPress FV Flowplayer Video Player Plugin <= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Foliovision
Products
Fv Flowplayer Video Player