CveMateVulnerability intelligence

Foliovision vulnerabilities

36 vulnerabilities

Known vulnerabilities in Foliovision products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.

Products

10

FV Flowplayer Video Player24 vulnerabilities
FV Player 83 vulnerabilities
Foliopress Wysiwyg2 vulnerabilities
FV Flowplayer Video Player (Wordpress Plugin)2 vulnerabilities
FV Simpler SEO2 vulnerabilities
Filled In1 vulnerabilities
FV Antispam1 vulnerabilities
FV Descriptions1 vulnerabilities
FV Thoughtful Comments1 vulnerabilities
Fv Wordpress Flowplayer Plugin1 vulnerabilities

CVE-2026-86461foliovisionfv flowplayer video player+16d ago14-10-2026 17:29

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.CVE-2026-97398foliovisionfv flowplayer video player+17d ago14-10-2026 03:40

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.CVE-2026-95807foliovisionfv player 8+17d ago14-10-2026 03:39

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.CVE-2026-54868foliovisionfv simpler seo8d ago13-10-2026 05:50

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.CVE-2018-0642foliovisionfv flowplayer video player+18y ago07-09-2018 14:00

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2021-39350foliovisionfv flowplayer video player+25y ago06-10-2021 15:21

The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.CVE-2025-68579foliovisionfv simpler seo+110mo ago24-12-2025 13:10

Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through <= 1.9.6.CVE-2025-66102foliovisionfv antispam+110mo ago18-12-2025 07:22

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FV Antispam: from n/a through <= 2.7.CVE-2025-22628foliovisionfilled in+11y ago27-03-2025 15:30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.CVE-2025-24613foliovisionfv thoughtful comments+11y ago24-01-2025 17:24

Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.CVE-2025-32610foliovisionfoliopress_wysiwyg+11y ago09-04-2025 16:09

Cross-Site Request Forgery (CSRF) vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Foliopress WYSIWYG: from n/a through <= 2.6.18.CVE-2020-35748foliovisionfv flowplayer video player+15y ago15-01-2021 16:50

Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.CVE-2014-1232foliovisionfoliopress_wysiwyg+112y ago08-01-2014 15:00

Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2022-25607foliovisionfv flowplayer video player+24y ago18-03-2022 18:00

Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).CVE-2022-25613foliovisionfv flowplayer video player+24y ago04-04-2022 19:46

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.CVE-2011-4568foliovisionfv_wordpress_flowplayer_plugin+114y ago29-11-2011 11:00

Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.CVE-2024-56032foliovisionfv descriptions+11y ago02-01-2025 09:20

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Descriptions fv-descriptions allows Reflected XSS.This issue affects FV Descriptions: from n/a through <= 1.4.CVE-2024-502010webform maker by 10web – mobile-friendly drag & drop contact form builder+301y ago04-12-2024 08:22

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-32078foliovisionfv flowplayer video player+12y ago24-04-2024 15:40

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.CVE-2024-32955foliovisionfv flowplayer video player+12y ago24-04-2024 07:05

Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.