What’s Vulnerable › Products

foliovision FV Flowplayer Video Player vulnerabilities

28 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your foliovision FV Flowplayer Video Player version is affected

Latest foliovision FV Flowplayer Video Player vulnerabilities

• CVE-2026-109984 — FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments (CVSS 5.4)
• CVE-2026-110533 — FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
• CVE-2026-110001 — FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute (CVSS 5.4)
• CVE-2026-118079 — WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability (CVSS 7.2)
• CVE-2026-86461 — FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter (CVSS 8.8)
• CVE-2026-97398 — FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (CVSS 7.2)
• CVE-2026-97630 — FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute (CVSS 6.4)
• CVE-2026-42695 — WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-12135 — FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode (CVSS 6.4)
• CVE-2026-49773 — WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-7556 — FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text (CVSS 7.2)
• CVE-2024-5020 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
• CVE-2024-6338 — FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter (CVSS 8.8)
• CVE-2024-35631 — WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2024-32078 — WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability (CVSS 4.1)
• CVE-2024-32955 — WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
• CVE-2023-4520 — FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update (CVSS 6.1)
• CVE-2023-30499 — WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
• CVE-2023-25066 — WordPress FV Flowplayer Video Player Plugin <= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
• CVE-2022-25613 — WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2022-25607 — WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability (CVSS 7.2)
• CVE-2021-39350 — FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2020-35748 — (CVSS 5.4)
• CVE-2019-14800 — (CVSS 5.3)
• CVE-2019-14801 — (CVSS 9.8)