Threats tagged 'ghsa-p6m8-xf64-2rj4'

The FV Player 8 WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'fv_player_videos' parameter affecting all versions up to and including 8.1.9. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts into pages, which execute when viewed by others. Exploitation requires the 'Allow visitors to upload videos to their profile' setting to be enabled, as this setting controls access to the vulnerable save functionality.