Vulnerabilities

TI-2024-05882 CVE-2024-6338 · GHSA-wgpq-79rc-3fgg

FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter

MEDIUM 41

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplie…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00509 Published 2024-07-19 No fix listed CWE-89

TI-2023-04171 CVE-2023-4520 · GHSA-v3w9-6427-5g27

Cross-site scripting in FolioVision FV Flowplayer Video Player

LOW 28

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00558 Published 2023-08-25 No fix listed CWE-79

TI-2023-14335 CVE-2023-30499 · GHSA-3pv5-2f7m-jxm4

WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00399 Published 2023-08-18 No fix listed CWE-79

TI-2023-10538 CVE-2023-25066 · GHSA-rj4v-5cv9-wmrx

WordPress FV Flowplayer Video Player Plugin <= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00271 Published 2023-02-14 No fix listed CWE-352

TI-2022-09203 CVE-2022-25613 · GHSA-26h6-63w6-777w

Cross-site scripting in FolioVision FV Flowplayer Video Player

LOW 25

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00571 Published 2022-04-04 No fix listed CWE-79

TI-2022-09197 CVE-2022-25607 · GHSA-vg8x-cp5j-g9cw

WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability

LOW 33

Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00827 Published 2022-03-18 No fix listed CWE-89

TI-2021-16717 CVE-2021-39350 · GHSA-jfxr-v6vh-5957

FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting

LOW 32

The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in ve…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02248 Published 2021-10-06 No fix listed CWE-79

TI-2020-18201 CVE-2020-35748 · GHSA-w9rf-wf6f-8c9r

Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer…

LOW 26

Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00931 Published 2021-01-15 No fix listed CWE-79

TI-2019-11006 CVE-2019-14800 · GHSA-rq3g-fww2-2pvq

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to…

LOW 27

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01516 Published 2019-08-15 No fix listed CWE-200

TI-2019-11007 CVE-2019-14801 · GHSA-r692-mcxh-5fxg

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.

MEDIUM 46

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01815 Published 2019-08-09 No fix listed CWE-89

TI-2019-11005 CVE-2019-14799 · GHSA-2rfp-9gm7-h9x9

The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.

LOW 31

The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02022 Published 2019-08-09 No fix listed CWE-79

TI-2019-10205 CVE-2019-13573 · GHSA-8rq8-9c95-x5gx

A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin…

MEDIUM 49

A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04371 Published 2019-07-17 No fix listed CWE-89

TI-2018-00597 CVE-2018-0642 · GHSA-mv9w-m376-mf59

Cross-site scripting in FolioVision FV Flowplayer Video Player

LOW 29

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01044 Published 2018-09-07 No fix listed CWE-79

Vulnerabilities

Filters