Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: FV Flowplayer Video Player 7.5.56.7212 Clear all filters
TI-2026-85352 CVE-2026-85351 · GHSA-h9pq-8fc6-9cqw

Server-side request forgery in FV Player via Media Library import

Priority LOW 22

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contri…

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00162 Published 2026-11-05 Fixed in 7.5.56.7212 CWE-918
TI-2026-85351 CVE-2026-85347 · GHSA-8w8j-842q-xx4q

Stored XSS in FV Flowplayer Video Player via text lightbox caption

Priority LOW 32

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00235 Published 2026-11-05 Fixed in 7.5.56.7212 CWE-79
TI-2026-85350 CVE-2026-85346 · GHSA-4xwf-gr64-f25h

Missing authorization in FV Player exposes cloud storage file listings

Priority LOW 19

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permis…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0011 Published 2026-11-05 Fixed in 7.5.56.7212 CWE-862