Threats tagged 'ghsa-34fg-x55x-4jf3'

The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter. This affects all versions up to and including 7.5.56.7212. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and that the injected comment is approved before execution occurs on pages viewed by site visitors.