Threat database

The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a vulnerability allowing limited arbitrary file upload due to insufficient file type validation in the check_mimetype function. Authenticated users with subscriber-level access or higher can upload potentially executable files if the 'profile videos on bio' option is enabled, enabling remote code execution. Exploitation requires this specific plugin setting to expose a nonce on subscriber-accessible profile pages.

The FV Flowplayer Video Player WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the 'synopsis' shortcode attribute in all versions up to and including 7.5.54.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and the 'liststyle' attribute set to "season". The vulnerability has a high severity with a CVSS score of 7.2.

FV Player 8 WordPress plugin versions up to and including 8.1.7 are vulnerable to stored cross-site scripting (XSS) via the 'synopsis' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. Additionally, unauthenticated visitors can exploit this vulnerability if the 'Parse Vimeo and YouTube links' setting is enabled, as it processes shortcodes in comment text.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.

CVE-2026-42699 is a high-severity vulnerability in FolioVision FV Player 8 versions up to 8.1.8. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can be triggered without authentication and affects confidentiality, integrity, and availability to a limited extent.

FV Player 8 WordPress plugin versions up to 8.1.7 have an arbitrary file upload vulnerability due to insufficient file type validation and missing capability checks. Authenticated users with subscriber-level access or higher can exploit a race condition in the check_mimetype function to upload potentially executable files, enabling remote code execution. The vulnerability has a high severity score of 8.8 CVSS 3.1.

The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of an unquoted popup shortcode attribute, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the profile_videos_enable_bio option to be enabled, as the injected scripts execute on author bio or archive pages where the profile-video shortcode is rendered. The vulnerability has a medium severity with a CVSS score of 6.4.

CVE-2026-42695 is a stored cross-site scripting (XSS) vulnerability in the FolioVision FV Flowplayer Video Player WordPress plugin. It affects versions from the initial release up to 7.5.54.7212. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with low privileges and requiring user interaction to execute malicious scripts. The CVSS score is 6.5, indicating a medium severity level. No official patch or vendor advisory is provided in the data. There are no known exploits in the wild at this time.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

The FV Flowplayer Video Player WordPress plugin is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 7.5.49.7212. The vulnerability arises from insufficient input sanitization and output escaping of comment text when the non-default 'Parse Vimeo and YouTube links' setting is enabled. An unauthenticated attacker can inject malicious scripts via comments that execute when users view the affected pages, but exploitation requires administrator approval of the comment. This vulnerability has a high severity score of 7.2.

Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through <= 1.9.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FV Antispam: from n/a through <= 2.7.

Cross-Site Request Forgery (CSRF) vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Foliopress WYSIWYG: from n/a through <= 2.6.18.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.

Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Descriptions fv-descriptions allows Reflected XSS.This issue affects FV Descriptions: from n/a through <= 1.4.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.