WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

WordPress HTML5 Video Player - SQL Injection

WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks. id: CVE-2024-1061 info: name: WordPress HTML5 Video Player - SQL Injection author: xxcdd severity: critical description: | WordPress HTM...

CVE-2026-85347

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the...

CVE-2026-85351

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery SSRF...

CVE-2026-85346

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions such as Subscriber to disclose the configuration and stored file listin...

CVE-2026-85347

The FV Flowplayer Video Player WordPress plugin, versions before 7.5.56.7212 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape user-supplied values before they are outputted on a page, specifically related to the Text Lightb...

EUVD-2026-117337

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery SSRF...

CVE-2026-85351

The FV Flowplayer Video Player WordPress plugin (versions before 7.5.56.7212 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs before performing a server-side fetch. An attacker with Contributor-level access or higher c...

EUVD-2026-117336

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the...

CVE-2026-85346

The FV Flowplayer Video Player WordPress plugin, in versions prior to 7.5.56.7212 , is vulnerable to unauthorized information disclosure. The flaw stems from a lack of authorization and CSRF checks on multiple cloud storage media browser handlers. This allows any authenticated user with minimal p...

EUVD-2026-117335

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions such as Subscriber to disclose the configuration and stored file listin...

CVE-2026-108067

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other...

CVE-2026-108068

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer...

CVE-2026-108068 FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer...

EUVD-2026-116717

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer...

CVE-2026-108068

The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 contains a vulnerability where it fails to perform adequate authorization checks on a specific video-migration function . While the function is protected by a nonce , the lack of proper authorization allows users with Con...

WordPress FV Flowplayer Video Player plugin 7.4.44.727-7.5.56.7211 - Contributor+ Bulk Video Record Disclosure and Modification vulnerability

Contributor+ Bulk Video Record Disclosure and Modification vulnerability discovered by RIA Labs in WordPress Plugin FV Flowplayer Video Player versions 7.4.44.727-7.5.56.7211...

CVE-2026-108067 FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other...

WordPress FV Flowplayer Video Player plugin < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure vulnerability

Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure vulnerability discovered by RIA Labs in WordPress Plugin FV Flowplayer Video Player versions 7.5.56.7212...

CVE-2026-108067

The FV Flowplayer Video Player WordPress plugin (versions before 7.5.56.7212 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to properly verify record ownership before allowing operations on stored video and meta records. Consequently, authenticated users with...