Foliovision FV Flowplayer Video Player vulnerabilities

24 vulnerabilities

Known vulnerabilities in Foliovision FV Flowplayer Video Player, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8HighCVE-2026-86461foliovision · fv flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' ParameterThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.EPSS0.74%7.2HighCVE-2026-97398foliovision · fv flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode AttributeThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.EPSS0.31%6.1MediumCVE-2018-0642foliovision · fv flowplayer video player +1 morefoliovision fv flowplayer video playerCross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.EPSS1.04%6.1MediumCVE-2021-39350foliovision · fv flowplayer video player +2 moreFV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site ScriptingThe FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.EPSS2.25%6.4MediumCVE-2020-35748foliovision · fv flowplayer video player +1 morefoliovision fv flowplayer video playerCross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.EPSS0.93%7.2HighCVE-2022-25607foliovision · fv flowplayer video player +2 moreWordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerabilityAuthenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).EPSS0.83%6.4MediumCVE-2022-25613foliovision · fv flowplayer video player +2 moreWordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityAuthenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.EPSS0.57%6.4MediumCVE-2024-502010web · form maker by 10web – mobile-friendly drag & drop contact form builder +30 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryMultiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.43%5.4MediumCVE-2024-32078foliovision · fv flowplayer video player +1 moreWordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerabilityURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.EPSS0.34%6.4MediumCVE-2024-32955foliovision · fv flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerabilityServer-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.EPSS0.25%8.8HighCVE-2024-6338foliovision · fv flowplayer video player +1 moreFV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude ParameterThe FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.51%7.1HighCVE-2024-35631foliovision · fv flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.EPSS0.27%10CriticalCVE-2019-13573foliovision · fv flowplayer video player +1 morefoliovision fv flowplayer video playerA SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.EPSS4.37%9.8CriticalCVE-2019-14801foliovision · fv flowplayer video player +1 morefoliovision fv flowplayer video playerThe FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.EPSS1.81%6.1MediumCVE-2019-14799foliovision · fv flowplayer video player +1 morefoliovision fv flowplayer video playerThe FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.EPSS2.02%5.3MediumCVE-2019-14800foliovision · fv flowplayer video player +1 morefoliovision fv flowplayer video playerThe FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.EPSS1.52%6.5MediumCVE-2026-42695foliovision · fv flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.EPSS0.13%7.2HighCVE-2026-7556foliovision · fv flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment TextThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled the non-default 'Parse Vimeo and YouTube links' (parse_comments) plugin setting, and requires a submitted comment to be approved by an administrator before the payload is publicly delivered.EPSS0.42%6.5MediumCVE-2026-49773foliovision · fv flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerabilitySubscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.EPSS0.22%6.4MediumCVE-2026-12135foliovision · fv flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' ShortcodeThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.35%