FF
Product
FV Flowplayer Video Player
25
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 2High 8Medium 15Low 0
Watch
Add FV Flowplayer Video Player to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-14801 | 9.8 | Aug 9 | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection Affected: before 7.3.15.727 |
| CVE-2019-13573 | 9.8 | Jul 17 | A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress Affected: before 7.3.19.727 |
| CVE-2026-86461 | 8.8 | Oct 14 | FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter Affected: through 7.5.54.7212 |
| CVE-2024-6338 | 8.8 | Jul 19 | FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter Affected: through 7.5.46.7212 |
| CVE-2023-25066 | 8.8 | Feb 14 | Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions Affected: through 7.5.30.7212 |
| CVE-2026-118079 New | 7.2 | Oct 29 | WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability Affected: through 8.3.4 |
| CVE-2026-97398 | 7.2 | Oct 14 | FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute Affected: through 7.5.54.7212 |
| CVE-2026-7556 | 7.2 | Jun 9 | FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text Affected: through 7.5.49.7212 |
| CVE-2022-25607 | 7.2 | Mar 18 | Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727) Affected: through 7.5.15.727 |
| CVE-2024-35631 | 7.1 | Jun 3 | WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability Affected: through 7.5.45.7212 |
| CVE-2026-42695 | 6.5 | Oct 9 | WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability Affected: through 7.5.54.7212 |
| CVE-2026-49773 | 6.5 | Jun 15 | WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability Affected: before 7.5.51.7212 |
| CVE-2026-97630 | 6.4 | Oct 10 | FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute Affected: through 7.5.54.7212 |
| CVE-2026-12135 | 6.4 | Jul 1 | FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode Affected: through 7.5.51.7212 |
| CVE-2024-5020 | 6.4 | Dec 4 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Affected: through 7.5.47.7212 |
| CVE-2023-4520 | 6.1 | Aug 25 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via… Affected: through 7.5.37.7212 |
| CVE-2023-30499 | 6.1 | Aug 18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions Affected: through 7.5.32.7212 |
| CVE-2021-39350 | 6.1 | Oct 6 | The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows… Affected: 7.5.0.727 through 7.5.2.727 |
| CVE-2019-14799 | 6.1 | Aug 9 | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS Affected: before 7.3.14.727 |
| CVE-2018-0642 | 6.1 | Sep 7 | Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 6.1.2 through 6.6.4 |
| CVE-2022-25613 | 5.4 | Apr 4 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash… Affected: through 7.5.18.727 |
| CVE-2020-35748 | 5.4 | Jan 15 | Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to… Affected: before 7.4.37.727 |
| CVE-2019-14800 | 5.3 | Aug 15 | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the… Affected: before 7.3.15.727 |
| CVE-2024-32955 | 4.9 | Apr 24 | WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability Affected: through 7.5.43.7212 |
| CVE-2024-32078 | 4.1 | Apr 24 | WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability Affected: through 7.5.44.7212 |
Showing 25