CVE-2011-4568

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-11-29 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.

Affected products

FolioVision Fv Wordpress Flowplayer Plugin: through 1.12.11; 0.9.12, 0.9.13, 0.9.14, 0.9.15, 0.9.16, 0.9.18 (+19)

References

http://plugins.trac.wordpress.org/changeset?reponame=&new=413607%40fv-wordpress-flowplayer&old=409594%40fv-wordpress-flowplayer
http://secunia.com/advisories/46346
http://wordpress.org/extend/plugins/fv-wordpress-flowplayer/changelog/
http://www.securityfocus.com/bid/50008
http://plugins.trac.wordpress.org/changeset?reponame=&new=413607%40fv-wordpress-flowplayer&old=409594%40fv-wordpress-flowplayer
http://secunia.com/advisories/46346
http://wordpress.org/extend/plugins/fv-wordpress-flowplayer/changelog/
http://www.securityfocus.com/bid/50008

Get alerted when CVE-2011-4568 or the next vulnerability affects your stack