Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

99 results · page 2 of 2

Feb 24, 2025Live Streaming Video Player – by SRS Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-player allows DOM-Based XSS.This issue affects Live Streaming Video Player – by SRS Player: from n/a through <= 1.0.18.
Product
Live Streaming Video Player – by SRS Player
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Live Streaming Video Player – by SRS Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2025HTML5 Video Player – mp4 Video Player Plugin and Block: DOM-Based Stored Cross-Site ScriptingCVE-2024-13156 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parameter in all versions up to, and including, 2.5.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HTML5 Video Player – mp4 Video Player Plugin and Block
Affected
up to 2.5.35
What to do
Affects up to 2.5.35. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024Floating Video Player: Cross-Site Request Forgery (CSRF)CVE-2024-54421 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sanjay_Negi Floating Video Player floating-player allows Stored XSS.This issue affects Floating Video Player: from n/a through <= 1.0.
Product
Floating Video Player
Affected
up to 1.0
What to do
Affects up to 1.0. Update Floating Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024Silverlight Video Player: Cross-Site Request Forgery (CSRF)CVE-2024-53713 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rickota Silverlight Video Player smooth-streaming-player allows Stored XSS.This issue affects Silverlight Video Player: from n/a through <= 1.0.
Product
Silverlight Video Player
Affected
up to 1.0
What to do
Affects up to 1.0. Update Silverlight Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 1, 2024Video Player for WPBakery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53747 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nutttaro Video Player for WPBakery video-player-for-wpbakery allows Stored XSS.This issue affects Video Player for WPBakery: from n/a through <= 1.0.1.
Product
Video Player for WPBakery
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Video Player for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Hola Free Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51854 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in holanetworks Hola Free Video Player hola-free-video-player allows DOM-Based XSS.This issue affects Hola Free Video Player: from n/a through <= 1.3.9.
Product
Hola Free Video Player
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Hola Free Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Advanced Video Player with Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51824 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karam Singh Advanced Video Player with Analytics advanced-video-player-with-analytics allows DOM-Based XSS.This issue affects Advanced Video Player with Analytics: from n/a through <= 1.
Product
Advanced Video Player with Analytics
Affected
up to 1
What to do
Affects up to 1. Update Advanced Video Player with Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 5, 2024Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical aCVE-2024-49404 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android 14 allows physical attackers to access video file of other users.
Product
Samsung Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Oct 29, 2024Agile Video Player Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woracal Agile Video Player Lite agile-video-player allows Reflected XSS.This issue affects Agile Video Player Lite: from n/a through <= 1.0.
Product
Agile Video Player Lite
Affected
up to 1.0
What to do
Affects up to 1.0. Update Agile Video Player Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2024HTML5 Video Player – mp4 Video Player Plugin and Block: Unauthorized access of dataCVE-2024-7727 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data.
Product
HTML5 Video Player – mp4 Video Player Plugin and Block
Affected
up to 2.5.32
What to do
Affects up to 2.5.32. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2024HTML5 Video Player – mp4 Video Player Plugin and Block: Unauthorized modification of dataCVE-2024-7721 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled.
Product
HTML5 Video Player – mp4 Video Player Plugin and Block
Affected
up to 2.5.34
What to do
Affects up to 2.5.34. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 19, 2024FV Flowplayer Video Player: Time-based SQL InjectionCVE-2024-6338 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
FV Flowplayer Video Player
Affected
up to 7.5.46.7212
What to do
Affects up to 7.5.46.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024HTML5 Video Player: Does not sanitize and escape a parameter from a REST route before using it in a SQL statementCVE-2024-5522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
HTML5 Video Player
Fixed in
2.5.27
What to do
Update HTML5 Video Player to 2.5.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.
Product
FV Flowplayer Video Player
Affected
up to 7.5.45.7212
What to do
Affects up to 7.5.45.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024FV Flowplayer Video Player: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-32078 · WordPress plugins & themes · reported by PatchstackMedium 4.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.
Product
FV Flowplayer Video Player
Affected
up to 7.5.44.7212
What to do
Affects up to 7.5.44.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024FV Flowplayer Video Player: Server-Side Request Forgery (SSRF)CVE-2024-32955 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.
Product
FV Flowplayer Video Player
Affected
up to 7.5.43.7212
What to do
Affects up to 7.5.43.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Ultimate Video Player For WordPress: Does not have proper capability checkCVE-2024-2428 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
Product
Ultimate Video Player For WordPress
Fixed in
2.2.3
What to do
Update Ultimate Video Player For WordPress to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2024Post Video Players: Cross-Site Request Forgery (CSRF)CVE-2024-23515 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159.
Product
Post Video Players
Affected
up to 1.159
What to do
Affects up to 1.159. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22299 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
Product
FV Flowplayer Video Player
Affected
up to 7.5.41.7212
What to do
Affects up to 7.5.41.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29122 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
Product
FV Flowplayer Video Player
Affected
up to 7.5.41.7212
What to do
Affects up to 7.5.41.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Easy Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.
Product
Easy Video Player
Affected
up to 1.2.2.10
What to do
Affects up to 1.2.2.10. Update Easy Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 30, 2024the 'id' parameter in the 'get_view' function: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injectionCVE-2024-1061 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
Product
the 'id' parameter in the 'get_view' function
Fixed in
2.5.25
What to do
Update the 'id' parameter in the 'get_view' function to 2.5.25 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 1, 2024Html5 Video Player: Does not sanitise and escape some of its player settingsCVE-2023-6485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
Product
Html5 Video Player
Fixed in
2.5.19
What to do
Update Html5 Video Player to 2.5.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2023HDW Player Plugin (Video Player & Video Gallery): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49178 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gallery) allows Reflected XSS.This issue affects HDW Player Plugin (Video Player & Video Gallery): from n/a through 5.0.
Product
HDW Player Plugin (Video Player & Video Gallery)
Affected
up to 5.0
What to do
Affects up to 5.0. Update HDW Player Plugin (Video Player & Video Gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the currentCVE-2023-47453 · Other software · Sohu · reported by MITREHigh 7.8
An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the current working directory.
Product
Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 24, 2023FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2023-4520 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and including, 7.5.37.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, and makes it possible to update the user metas arbitrarily, but the meta value can only be a string.
Product
FV Flowplayer Video Player
Affected
up to 7.5.37.7212
What to do
Affects up to 7.5.37.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.CVE-2023-25066 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.
Affected
up to 7.5.30.7212
What to do
Affects up to 7.5.30.7212. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2022Flowplayer Video Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3984 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
Flowplayer Video Player
Fixed in
1.0.5
What to do
Update Flowplayer Video Player to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Easy Video Player: Does not sanitize and escapes some parametersCVE-2022-3937 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Product
Easy Video Player
Fixed in
1.2.2.3
What to do
Update Easy Video Player to 1.2.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022FV Flowplayer Video Player: Authenticated Persistent Cross-Site Scripting (XSS)CVE-2022-25613 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.
Product
FV Flowplayer Video Player
Affected
up to 7.5.18.727
What to do
Affects up to 7.5.18.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727)CVE-2022-25607 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).
Affected
up to 7.5.15.727
What to do
Affects up to 7.5.15.727. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 11, 2022Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission.CVE-2022-24927 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.2
Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission.
Product
Samsung Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Oct 25, 2021Video Player for YouTube: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Video Player for YouTube
Fixed in
1.4
What to do
Update Video Player for YouTube to 1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 6, 2021FV Flowplayer Video Player: Reflected Cross-Site ScriptingCVE-2021-39350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
Product
FV Flowplayer Video Player
Affected
7.5.0.727 to 7.5.2.727
What to do
Affects 7.5.0.727 to 7.5.2.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 15, 2021Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authentCVE-2020-35748 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
Product
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player
Fixed in
7.4.37.727
What to do
Update Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player to 7.4.37.727 or newer.
Full record and what to do →NVD record docs.google.com github.com
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.CVE-2019-14801 · WordPress plugins & themes · reported by MITRECritical 9.8
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.CVE-2019-14799 · WordPress plugins & themes · reported by MITREMedium 6.1
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
Product
FV Flowplayer Video Player
Fixed in
7.3.14.727
What to do
Update FV Flowplayer Video Player to 7.3.14.727 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Jul 17, 2019A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.CVE-2019-13573 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
Product
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player
Fixed in
7.3.19.727
What to do
Update A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player to 7.3.19.727 or newer.
Full record and what to do →NVD record fortiguard.com plugins.trac.wordpress.org
Sep 7, 2018FV Flowplayer Video Player 6.1.2 to 6.6.4: Cross-site scriptingCVE-2018-0642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
FV Flowplayer Video Player 6.1.2 to 6.6.4
Affected
6.1.2 to 6.6.4
What to do
Affects 6.1.2 to 6.6.4. Update FV Flowplayer Video Player 6.1.2 to 6.6.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jun 15, 2015Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administratCVE-2015-4352 · Other software · Web-dorado · reported by MITREMedium 5.8
Cross-site request forgery (CSRF) vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors.
Product
Web-dorado Spider Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Jun 15, 2015The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary CVE-2015-4351 · Other software · Web-dorado · reported by MITREMedium 4.9
The Spider Video Player module for Drupal allows remote authenticated users with the "access Spider Video Player administration" permission to delete arbitrary files via a crafted URL.
Product
Web-dorado Spider Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
Nov 4, 2014Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attaCVE-2014-8584 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player)
Fixed in
1.5.2
What to do
Update Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) to 1.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Sep 18, 2014The VPlayer Video Player (aka me.abitno.vplayer.t) application 3.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-miCVE-2014-5956 · Other software · Vplayer · reported by cret@cert.orgMedium 5.4
The VPlayer Video Player (aka me.abitno.vplayer.t) application 3.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Vplayer Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress aCVE-2014-4534 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.
Product
HTML5 Video Player with Playlist
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update HTML5 Video Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Apr 11, 2014Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of adCVE-2013-2706 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
Product
Stream Video Player
What to do
Update Stream Video Player to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
May 10, 2013SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commCVE-2013-3532 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.
Product
Web Dorado Spider Video Player
What to do
Update Web Dorado Spider Video Player to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 23, 2009Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkinCVE-2009-0261 · Other software · Effectmatrix · reported by MITREHigh 9.3
Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value.
Product
Total Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Feb 14, 2007Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers to execute arbitrary code via a M3U playlCVE-2007-0949 · Other software · Itinysoft Studio · reported by MITREHigh 10
Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers to execute arbitrary code via a M3U playlist file that contains a long file name. NOTE: it was later reported that 1.20 and 1.30 are also affected.
Product
Total Video Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.