Threats tagged 'ghsa-7p26-8g5q-c3vw'

The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 have an authorization flaw in a video-migration function. This function relies solely on a nonce for protection, which is insufficient. As a result, users with Contributor-level permissions or higher can disclose and bulk-modify stored video records across the entire site.