FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS

2019-05-2000:00:00

WebARX Security

0.002 Low

EPSS

Percentile

53.6%

JSON

The vulnerable function is exposed to unauthenticated users over wp_ajax_nopriv_fv_wp_flowplayer_email_signup ajax hook. It saves anything that user provides in email POST parameter.

Send POST request to wp-admin/admin-ajax.php with body content:

"action=fv_wp_flowplayer_email_signup&list=1&email=<svg/onload=prompt(1)>@test.com"

The provided email input is then rendered on email export screen.