Advisories · Technology

foliovision FV Flowplayer Video Player.

Every CVE that names foliovision FV Flowplayer Video Player among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-109984 CVE record

CVSS 5.4 Medium

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2026
CVE-2026-110533 CVE record

CVSS 6.4 Medium

FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2026
CVE-2026-110001 CVE record

CVSS 5.4 Medium

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 30 Oct 2026
CVE-2026-118079 CVE record

CVSS 7.2 High

WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability
- FolioVision FV Flowplayer Video Player
- Insecure deserialization
Not analysed yet 29 Oct 2026
CVE-2026-86461 CVE record

CVSS 8.8 High

FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
- foliovision FV Flowplayer Video Player
- Unrestricted file upload
Not analysed yet 14 Oct 2026
CVE-2026-97398 CVE record

CVSS 7.2 High

FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-97630 CVE record

CVSS 6.4 Medium

FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42695 CVE record

CVSS 6.5 Medium

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability
- FolioVision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 9 Oct 2026
CVE-2026-12135 CVE record

CVSS 6.4 Medium

FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 1 Jul 2026
CVE-2026-49773 CVE record

CVSS 6.5 Medium

WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability
- FolioVision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 15 Jun 2026
CVE-2026-7556 CVE record

CVSS 7.2 High

FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 9 Jun 2026
CVE-2024-5020 CVE record

CVSS 6.4 Medium

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
- extendthemes Colibri Page Builder
- smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
- Cross-site scripting (XSS)
Not analysed yet 4 Dec 2024
CVE-2024-6338 CVE record

CVSS 8.8 High

FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
- foliovision FV Flowplayer Video Player
- SQL injection
Not analysed yet 19 Jul 2024
CVE-2024-35631 CVE record

CVSS 7.1 High

WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability
- Foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 3 Jun 2024
CVE-2024-32078 CVE record

CVSS 4.1 Medium

WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability
- Foliovision FV Flowplayer Video Player
- Open redirect
Not analysed yet 24 Apr 2024
CVE-2024-32955 CVE record

CVSS 4.9 Medium

WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability
- Foliovision FV Flowplayer Video Player
- Server-side request forgery (SSRF)
Not analysed yet 24 Apr 2024
CVE-2023-4520 CVE record

CVSS 5.4 Medium

FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 25 Aug 2023
CVE-2023-30499 CVE record

CVSS 7.1 High

WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)
- FolioVision FV Flowplayer Video Player
- Cross-site scripting (XSS)
Not analysed yet 18 Aug 2023
CVE-2023-25066 CVE record

CVSS 4.3 Medium

WordPress FV Flowplayer Video Player Plugin <= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF)
- FolioVision FV Flowplayer Video Player
- Cross-site request forgery (CSRF)
Not analysed yet 14 Feb 2023
CVE-2018-0642 CVE record

Foliovision FV Flowplayer Video Player: Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows…
- Foliovision FV Flowplayer Video Player
Not analysed yet 7 Sept 2018