Lucene search
WebARX SecurityWPVDB-ID:A60DA1A3-0509-4409-B8B9-8660BE0FC18EHistoryMay 20, 2019 - 12:00 a.m.
FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS
2019-05-2000:00:00
WebARX Security
wpscan.com
12
0.002 Low
EPSS
Percentile
53.6%
The vulnerable function is exposed to unauthenticated users over wp_ajax_nopriv_fv_wp_flowplayer_email_signup ajax hook. It saves anything that user provides in email POST parameter.
PoC
Send POST request to wp-admin/admin-ajax.php with body content: “action=fv_wp_flowplayer_email_signup&list;=1&email;[email protected]” The provided email input is then rendered on email export screen.
| CPE | Name | Operator | Version |
|---|---|---|---|
| fv-wordpress-flowplayer | lt | 7.3.14.727 |
Related
wpexploit
wpexploit
FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS
2019-05-20 00:00:00
prion
prion
Cross site scripting
2019-08-09 13:15:00
cvelist
cvelist
CVE-2019-14799
2019-08-09 12:18:29
nvd
nvd
CVE-2019-14799
2019-08-09 13:15:12
openvas
openvas
WordPress FV Flowplayer Video Player Plugin < 7.3.14.727 XSS Vulnerability
2022-07-29 00:00:00
cve
cve
CVE-2019-14799
2019-08-09 13:15:12