Threats tagged 'ghsa-9vc5-7wqc-m5wc'

The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of an unquoted popup shortcode attribute, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the profile_videos_enable_bio option to be enabled, as the injected scripts execute on author bio or archive pages where the profile-video shortcode is rendered. The vulnerability has a medium severity with a CVSS score of 6.4.