CVE-2026-85351

The FV Flowplayer Video Player WordPress plugin (versions before 7.5.56.7212 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs before performing a server-side fetch. An attacker with Contributor-level access or higher c...

CVE-2026-107321

The W3 Total Cache WordPress plugin, in versions prior to 2.10.6 , is vulnerable to a path traversal flaw during the media-import process. The plugin fails to confine file copies to the document root and lacks effective file-type restrictions. This allows users with Author privileges or higher to...