FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS

The vulnerable function is exposed to unauthenticated users over wpajaxnoprivfvwpflowplayeremailsignup ajax hook. It saves anything that user provides in email POST parameter. Send POST request to wp-admin/admin-ajax.php with body content: "action=fvwpflowplayeremailsignup&list=1&[email protected]"...

WordPress FV Flowplayer Video Player plugin <= 7.2.0.727 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Janek Vind "waraxe" in WordPress FV Flowplayer Video Player plugin versions = 7.2.0.727. Solution Update the WordPress FV Flowplayer Video Player plugin to the latest available version at least 7.2.1.727...

CVE-2018-0642

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0642

The CVE-2018-0642 entry describes a Cross-Site Scripting (XSS) vulnerability in the WordPress FV Flowplayer Video Player plugin, affected versions 6.1.2 through 6.6.4. The underlying issue is an XSS flaw that could allow an attacker to inject arbitrary script or HTML, with vectors and impact desc...

CVE-2018-0642

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0642: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2018-8981

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player versions 6.1.2 through 6.6.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions 6.1.2 through 6.6.4, update to a version that contain...

JVN#70246549: WordPress plugin "FV Flowplayer Video Player" vulnerable to cross-site scripting

The WordPress plugin "FV Flowplayer Video Player" provided by Foliovision contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the plugin Update the plugin according to the information provided by the developer...