FV Flowplayer Video Player

Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is n/a through 8.3.4.

FV Flowplayer Video Player incompletely validates remotely supplied file content in check_mimetype(): extension checks can be bypassed, and files are written without a MIME check or a WordPress upload helper. A Subscriber or higher can reach the disclosed upload path when the profile videos on bio option exposes the required nonce on the user profile page. Without that setting, users below Editor cannot obtain the nonce through this path. Uploaded content may be executable, so code execution depends on the accepted file and hosting execution rules. The export does not identify the upload endpoint or remote-file parameter. Published affected versions: <= 7.5.54.7212.

FV Flowplayer Video Player can process a crafted synopsis shortcode in a public comment and render stored script. The unauthenticated route requires parse_comments to be enabled and the player to use liststyle=season. The export does not identify another route that removes those prerequisites. Published affected versions: <= 7.5.54.7212.

A Subscriber or higher can put a script payload in an unquoted popup shortcode attribute within their profile biography. The profile_videos_enable_bio option must be enabled and the author biography or archive must render the shortcode. Those conditions allow stored script execution for viewers. Affected versions: <= 7.5.54.7212. The matching official changelog confirms 7.5.55.7212 as fixed for this CVE.

The supplied vector requires low privileges; the exact WordPress role is not identified. Attacker-controlled content can be saved and later rendered without sufficient neutralization, allowing script execution under the site's origin in a viewer's session. The export does not identify the input field, storage operation, rendering function, output context or victim role. Victim interaction is required by the vector. The vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: <= 7.5.54.7212. The authoritative export identifies 7.5.55.7212 as fixed for this CVE.

FV Flowplayer Video Player is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 7.5.51.7212.

FV Flowplayer Video Player is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a to < 7.5.51.7212.

FV Flowplayer Video Player is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 7.5.49.7212.

FV Flowplayer Video Player is affected by SQL injection. Exploitation requires an authenticated subscriber account. A successful request can alter database queries and expose or modify WordPress data.

FV Flowplayer Video Player is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

FV Flowplayer Video Player is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.

FV Flowplayer Video Player is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

FV Flowplayer Video Player is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

FV Flowplayer Video Player is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

FV Flowplayer Video Player is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fv Wordpress Flowplayer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fv Wordpress Flowplayer is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Fv Wordpress Flowplayer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fv Wordpress Flowplayer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Fv Wordpress Flowplayer is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Fv Wordpress Flowplayer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Fv Wordpress Flowplayer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Fv Wordpress Flowplayer is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Fv Wordpress Flowplayer is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.