Skip to content
Noroxi

FV Flowplayer Video Player

fv-wordpress-flowplayer · plugin

Known security vulnerabilities for FV Flowplayer Video Player. Find out in seconds which version runs on your site with WP Lens.

21 known vulnerabilities

2 critical · 12 exploitable without logging in · 1 with public exploit code · latest Jul 1, 2026

Listed on wordpress.org · latest 7.5.54.7212 · last updated Aug 18, 2026 · 10K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2019-14801unauthenticated

    The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.

    Critical 9.8

  • CVE-2019-13573unauthenticated

    A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.

    Critical 9.8

  • CVE-2023-25066unauthenticated · needs a click≤ 7.5.30.7212

    WordPress FV Flowplayer Video Player Plugin <= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2024-6338subscriber+≤ 7.5.46.7212

    FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter

    High 8.8

  • CVE-2026-7556unauthenticated≤ 7.5.49.7212

    FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text

    High 7.2

  • CVE-2022-25607author+≤ 7.5.15.727

    WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability

    High 7.2

  • CVE-2024-35631unauthenticated · needs a click≤ 7.5.45.7212

    WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2024-22299unauthenticated · needs a click≤ 7.5.41.7212

    WordPress FV Player plugin <= 7.5.41.7212 - Reflected Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-49773subscriber+→ 7.5.51.7212

    WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2024-29122login required≤ 7.5.41.7212

    WordPress FV Player plugin <= 7.5.41.7212 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-12135contributor+≤ 7.5.51.7212

    FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode

    Medium 6.4

  • CVE-2023-4520unauthenticated≤ 7.5.37.7212

    FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update

    Medium 6.1

  • CVE-2023-30499unauthenticated · needs a click≤ 7.5.32.7212

    WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2021-39350unauthenticated · needs a click

    FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2019-14799unauthenticated · needs a click

    The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.

    Medium 6.1

  • CVE-2018-0642unauthenticated · needs a click

    Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HT

    Medium 6.1

  • CVE-2022-25613login required≤ 7.5.18.727

    WordPress FV Flowplayer Video Player plugin <= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2019-14800unauthenticated

    The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via

    Medium 5.3

  • CVE-2024-32955login required≤ 7.5.43.7212

    WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability

    Medium 4.9

  • CVE-2011-4568

    Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attack

    Medium 4.3

  • CVE-2024-32078login required≤ 7.5.44.7212

    WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

    Medium 4.1

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory