Threats tagged 'ghsa-4x55-cc3w-xm8r'

The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.5.55.7212. This flaw arises from insufficient input sanitization and output escaping of the 'fv_player_videos[_fv_player_user_video][]' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts into pages, which execute when accessed by other users. Exploitation requires that an administrator has enabled the 'Allow visitors to upload videos to their profile' setting.