13 matches found
CVE-2019-13573
CVE-2019-13573 affects the FolioVision FV Flowplayer Video Player WordPress plugin, prior to version 7.3.19.727. The vulnerability is a SQL injection caused by lack of proper sanitization of user input, enabling a remote attacker to execute arbitrary SQL commands on the affected system. Some conn...
CVE-2022-25607
FV Flowplayer Video Player WordPress plugin (versions ≤ 7.5.15.727) is affected by an authenticated SQL Injection vulnerability due to insufficient input validation. The vulnerability affects the plugin when used with WordPress; impact is partial to high across confidentiality, integrity, and ava...
CVE-2020-35748
FV Flowplayer Video Player plugin for WordPress is affected by a cross-site scripting (XSS) vulnerability in models/list-table.php, fixed in versions 7.4.38.727 and later. The issue allows remote authenticated users to inject arbitrary script/HTML via the fv_wp_fvvideoplayer_src field in the data...
CVE-2022-25613
Summary : CVE-2022-25613 is an authenticated persistent Cross-Site Scripting (XSS) vulnerability in the WordPress FV Flowplayer Video Player plugin (versions
CVE-2021-39350
FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter in ~/view/stats.php (versions 7.5.0.727–7.5.2.727). An attacker can inject arbitrary scripts. Remediation: update to version 7.5.3.727 or later.
CVE-2019-14800
The CVE-2019-14800 issue affects the WordPress plugin FV Flowplayer Video Player prior to 7.3.15.727. It enables guests to exfiltrate the email subscription list in CSV format via wp-admin/admin-post.php?page=fvplayer&fv-email-export=1. The vulnerability is an information disclosure with partial ...
CVE-2024-6338
CVE-2024-6338 affects the FV Flowplayer Video Player plugin for WordPress. Versions up to and including 7.5.46.7212 are vulnerable to time-based SQL Injection via the exclude parameter due to insufficient escaping and query preparation, allowing authenticated attackers with Subscriber-level acces...
CVE-2019-14801
The CVE concerns the FV Flowplayer Video Player WordPress plugin prior to version 7.3.15.727, where an email subscription feature is vulnerable to SQL injection. Affected component: FV Flowplayer Video Player plugin for WordPress; root cause: lack of input validation in SQL statements used during...
CVE-2019-14799
The FV Flowplayer Video Player plugin for WordPress (versions prior to 7.3.14.727) exposes an XSS vulnerability via the unauthenticated AJAX endpoint wp-admin/admin-ajax.php, fv_wp_flowplayer_email_signup. An attacker can submit crafted data to the email parameter (e.g., via list=1 and email fiel...
CVE-2018-0642
The CVE-2018-0642 entry describes a Cross-Site Scripting (XSS) vulnerability in the WordPress FV Flowplayer Video Player plugin, affected versions 6.1.2 through 6.6.4. The underlying issue is an XSS flaw that could allow an attacker to inject arbitrary script or HTML, with vectors and impact desc...
CVE-2023-25066
CVE-2023-25066 is a Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin for WordPress, affected versions
CVE-2023-4520
CVE-2023-4520 affects FV Flowplayer Video Player for WordPress. A stored XSS via the _fv_player_user_video parameter saved through the plugin’s save function (hooked via init) and an Arbitrary Usermeta Update vulnerability exist in versions up to 7.5.37.7212 due to insufficient input sanitization...