CVE-2024-6338

🗓️ 19 Jul 2024 07:36:48Reported by WordfenceType

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the 'exclude' parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-6338	19 Jul 202411:11	–	circl
Cvelist	CVE-2024-6338 FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter	19 Jul 202407:36	–	cvelist
EUVD	EUVD-2024-47451	3 Oct 202520:07	–	euvd
NVD	CVE-2024-6338	19 Jul 202408:15	–	nvd
Patchstack	WordPress FV Flowplayer Video Player Plugin <= 7.5.46.7212 is vulnerable to SQL Injection	19 Jul 202400:00	–	patchstack
Patchstack	WordPress FV Player plugin <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter vulnerability	19 Jul 202402:49	–	patchstack
Positive Technologies	PT-2024-37550 · WordPress · Fv Flowplayer Video Player	19 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-6338	5 Feb 202502:54	–	redhatcve
Vulnrichment	CVE-2024-6338 FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter	19 Jul 202407:36	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (July 15, 2024 to July 21, 2024)	25 Jul 202414:49	–	wordfence

NVD

Vulners

Vulnrichment

Node

foliovision fv_flowplayer_video_playerRange<7.5.47.7212wordpress

[
  {
    "vendor": "foliovision",
    "product": "FV Flowplayer Video Player",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "7.5.46.7212",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordpress	www.wordpress.org/plugins/fv-wordpress-flowplayer/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d4185a0e-d944-408f-8a43-8f9c6bc3964d
plugins	www.plugins.trac.wordpress.org/changeset/3121532/
plugins	www.plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/video-encoder/class.fv-player-encoder-list-table.php

08 Apr 2026 17:25Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

EPSS0.0048

SSVC

CWE-89