VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

FV Flowplayer Video Player security & vulnerabilities

fv-wordpress-flowplayer— active installsLast vulnerability Nov 7, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
44Known vulnerabilities
  • Critical3
  • High7
  • Medium34
  • Low0
Vulnerabilities per year
2011: 1 vulnerability1112015: 1 vulnerability1152018: 2 vulnerabilities2182019: 6 vulnerabilities6192021: 2 vulnerabilities2212022: 2 vulnerabilities2222023: 3 vulnerabilities3232024: 7 vulnerabilities7242026: 20 vulnerabilities2026

All FV Flowplayer Video Player vulnerabilities

FV Flowplayer Video Player vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤7.5.56.7212Update to 7.5.57.7212
CVE-2026-121764
Medium5.4Unauthenticated Stored Cross-Site Scripting via Comment Content
≤7.5.56.7212Update to 7.5.57.7212
CVE-2026-121515
High7.2Unauthenticated Stored Cross-Site Scripting
≤7.5.57.7211Update to 7.5.57.7212
CVE-2026-117525
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference
<7.5.56.7212Update to 7.5.56.7212
CVE-2026-108067
Medium4.37.5.56.7211 - Missing Authorization
7.4.44.727 – 7.5.56.7211Update to 7.5.56.7212
CVE-2026-108068
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
≤7.5.56.7211Update to 7.5.56.7212
CVE-2026-85351
Medium4.3Missing Authorization
≤7.5.56.7211Update to 7.5.56.7212
CVE-2026-85346
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.5.56.7211Update to 7.5.56.7212
CVE-2026-85347
Medium5.4Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
≤7.5.55.7212Update to 7.5.56.7212
CVE-2026-109984
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
≤7.5.55.7212Update to 7.5.56.7212
CVE-2026-110533
Medium5.4Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
≤7.5.55.7212Update to 7.5.56.7212
CVE-2026-110001
Medium6.6Authenticated (Shop Manager+) PHP Object Injection
≤7.5.56.7212Update to 7.5.57.7212
CVE-2026-118079
High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
≤7.5.54.7212Update to 7.5.55.7212
CVE-2026-86461
Medium6.47.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery
7.5.44.7212 – 7.5.55.7211Update to 7.5.55.7212
CVE-2026-85345
High7.2Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
≤7.5.54.7212Update to 7.5.55.7212
CVE-2026-97398
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
≤7.5.54.7212Update to 7.5.55.7212
CVE-2026-97630
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤7.5.54.7212Update to 7.5.55.7212
CVE-2026-42695
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode
≤7.5.51.7212Update to 7.5.52.7212
CVE-2026-12135
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Text
≤7.5.49.7212Update to 7.5.50.7212
CVE-2026-7556
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
<7.5.51.7212Update to 7.5.51.7212
CVE-2026-49773
Medium6.4Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
≤3.59.4Update to 3.59.5
CVE-2024-5020
High8.8Authenticated (Subscriber+) SQL Injection via exclude Parameter
≤7.5.46.7212Update to 7.5.47.7212
CVE-2024-6338
Medium6.1Reflected Cross-Site Scripting
≤7.5.45.7212Update to 7.5.46.7212
CVE-2024-35631
Medium6.4Authenticated (Subscriber+) Server-side Request Forgery
≤7.5.43.7212Update to 7.5.45.7212
CVE-2024-32955
Medium5.4Authenticated (Contributor+) Arbitrary Redirect
≤7.5.44.7212Update to 7.5.45.7212
CVE-2024-32078
Medium6.1Reflected Cross-Site Scripting
≤7.5.41.7212Update to 7.5.44.7212
CVE-2024-22299
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤7.5.41.7212Update to 7.5.44.7212
CVE-2024-29122
Medium5.4Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update
≤7.5.37.7212Update to 7.5.39.7212
CVE-2023-4520
Medium6.1Reflected Cross-Site Scripting via id
≤7.5.32.7212Update to 7.5.35.7212
CVE-2023-30499
Medium4.3Cross-Site Request Forgery
≤7.5.30.7210Update to 7.5.31.7212
CVE-2023-25066
Medium6.4Stored Cross-Site Scripting
≤7.5.18.727Update to 7.5.19.728
CVE-2022-25613
High7.2SQL Injection
≤7.5.15.727Update to 7.5.18.727
CVE-2022-25607
Medium6.17.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter
7.5.0.727 – 7.5.2.727Update to 7.5.3.727
CVE-2021-39350
Medium6.4Authenticated Stored Cross-Site Scripting
≤7.4.37.727Update to 7.4.38.727
CVE-2020-35748
Critical9.8SQL Injection
≤7.3.18.727Update to 7.3.19.727
CVE-2019-13573
Critical9.8SQL Injection
<7.3.15.727Update to 7.3.15.727
CVE-2019-14801
Medium6.1Unauthenticated Stored Cross-Site Scripting
≤7.3.13.727Update to 7.3.14.727
CVE-2019-14799
Medium5.3Sensitive Information Exposure
≤7.3.14.727Update to 7.3.15.727
CVE-2019-14800
Medium5.3Sensitive Data Exposure
<7.3.15.727Update to 7.3.15.727
—
Critical9.3Unauthenticated SQL Injection
<7.3.15.727Update to 7.3.15.727
—
Medium6.1Reflected Cross-Site Scripting
≤7.2.0.727Update to 7.2.1.727
—
Medium6.16.6.4 - Cross-Site Scripting
6.1.2 – 6.6.4Update to 6.6.5
CVE-2018-0642
Medium5.3Stored Cross-Site Scripting
≤6.0.3.3Update to 6.0.3.4
—
Medium6.1Cross-Site Scripting
≤1.2.11Update to 1.2.12
CVE-2011-4568

FV Flowplayer Video Player: common questions

Does FV Flowplayer Video Player have known vulnerabilities?

Yes. VulnCrest Radar lists 44 known vulnerabilities in FV Flowplayer Video Player: 3 critical, 7 high, 34 medium. At least one is not fixed in the latest version.

How do I check which version of FV Flowplayer Video Player I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent FV Flowplayer Video Player vulnerability?

CVE-2026-121764, published Nov 7, 2026: FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any FV Flowplayer Video Player vulnerability listed in CISA KEV?

No. None of the known FV Flowplayer Video Player vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?