Login Request a demo
Medium severity · published Aug 25, 2023
CVE-2023-4520
FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and including, 7.5.37.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, and makes it possible to update the user metas arbitrarily, but the meta value can only be a string.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
FV Flowplayer Video Player · foliovision
through 7.5.37.7212 · source: vendor, NVD
Affected product
FF
FV Flowplayer Video Player
foliovision
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4520
Product
https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/tags/7.5.36.7212/models/custom-videos.php#L341
Patch
https://plugins.trac.wordpress.org/changeset/2957322/fv-wordpress-flowplayer#file2
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=cve
More from FV Flowplayer Video Player
9.8
CVE-2019-14801
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection
9.8
CVE-2019-13573
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress
8.8
CVE-2026-86461
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
8.8
CVE-2024-6338
FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
8.8
CVE-2023-25066
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions