WordPress plugin
FV Flowplayer Video Player security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High7
- Medium34
- Low0
All FV Flowplayer Video Player vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤7.5.56.7212Update to 7.5.57.7212 | CVE-2026-121764 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤7.5.57.7211Update to 7.5.57.7212 | CVE-2026-117525 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter ≤7.5.54.7212Update to 7.5.55.7212 | CVE-2026-86461 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute ≤7.5.54.7212Update to 7.5.55.7212 | CVE-2026-97398 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Comment Text ≤7.5.49.7212Update to 7.5.50.7212 | CVE-2026-7556 | |
| High8.8 | Authenticated (Subscriber+) SQL Injection via exclude Parameter ≤7.5.46.7212Update to 7.5.47.7212 | CVE-2024-6338 | |
| High7.2 | SQL Injection ≤7.5.15.727Update to 7.5.18.727 | CVE-2022-25607 | |
| Critical9.8 | SQL Injection ≤7.3.18.727Update to 7.3.19.727 | CVE-2019-13573 | |
| Critical9.8 | SQL Injection <7.3.15.727Update to 7.3.15.727 | CVE-2019-14801 | |
| Critical9.3 | Unauthenticated SQL Injection <7.3.15.727Update to 7.3.15.727 | — |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤7.5.56.7212Update to 7.5.57.7212
- High7.2Unauthenticated Stored Cross-Site Scripting
≤7.5.57.7211Update to 7.5.57.7212
- High8.8Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter
≤7.5.54.7212Update to 7.5.55.7212
- High7.2Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
≤7.5.54.7212Update to 7.5.55.7212
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Text
≤7.5.49.7212Update to 7.5.50.7212
- High8.8Authenticated (Subscriber+) SQL Injection via exclude Parameter
≤7.5.46.7212Update to 7.5.47.7212
- High7.2SQL Injection
≤7.5.15.727Update to 7.5.18.727
- Critical9.8SQL Injection
≤7.3.18.727Update to 7.3.19.727
- Critical9.8SQL Injection
<7.3.15.727Update to 7.3.15.727
- Critical9.3Unauthenticated SQL Injection
<7.3.15.727Update to 7.3.15.727
FV Flowplayer Video Player: common questions
Does FV Flowplayer Video Player have known vulnerabilities?
Yes. VulnCrest Radar lists 44 known vulnerabilities in FV Flowplayer Video Player: 3 critical, 7 high, 34 medium. At least one is not fixed in the latest version.
How do I check which version of FV Flowplayer Video Player I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent FV Flowplayer Video Player vulnerability?
CVE-2026-121764, published Nov 7, 2026: FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any FV Flowplayer Video Player vulnerability listed in CISA KEV?
No. None of the known FV Flowplayer Video Player vulnerabilities is currently listed in the CISA KEV catalog.