Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
82 results · page 2 of 2
Sep 11, 2024HTML5 Video Player – mp4 Video Player Plugin and Block: Unauthorized modification of dataCVE-2024-7721 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled.
- Product
- HTML5 Video Player – mp4 Video Player Plugin and Block
- Affected
- up to 2.5.34
- What to do
- Affects up to 2.5.34. Update HTML5 Video Player – mp4 Video Player Plugin and Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 19, 2024FV Flowplayer Video Player: Time-based SQL InjectionCVE-2024-6338 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.46.7212
- What to do
- Affects up to 7.5.46.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2024HTML5 Video Player: Does not sanitize and escape a parameter from a REST route before using it in a SQL statementCVE-2024-5522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- HTML5 Video Player
- Fixed in
- 2.5.27
- What to do
- Update HTML5 Video Player to 2.5.27 or newer.
Jun 3, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35631 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.45.7212
- What to do
- Affects up to 7.5.45.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024FV Flowplayer Video Player: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-32078 · WordPress plugins & themes · reported by PatchstackMedium 4.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.44.7212
- What to do
- Affects up to 7.5.44.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024FV Flowplayer Video Player: Server-Side Request Forgery (SSRF)CVE-2024-32955 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.43.7212.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.43.7212
- What to do
- Affects up to 7.5.43.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 10, 2024Ultimate Video Player For WordPress: Does not have proper capability checkCVE-2024-2428 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
- Product
- Ultimate Video Player For WordPress
- Fixed in
- 2.2.3
- What to do
- Update Ultimate Video Player For WordPress to 2.2.3 or newer.
Mar 27, 2024Post Video Players: Cross-Site Request Forgery (CSRF)CVE-2024-23515 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159.
- Product
- Post Video Players
- Affected
- up to 1.159
- What to do
- Affects up to 1.159. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22299 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.41.7212
- What to do
- Affects up to 7.5.41.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29122 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.41.7212
- What to do
- Affects up to 7.5.41.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 1, 2024Easy Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.
- Product
- Easy Video Player
- Affected
- up to 1.2.2.10
- What to do
- Affects up to 1.2.2.10. Update Easy Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 30, 2024the 'id' parameter in the 'get_view' function: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injectionCVE-2024-1061 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.6
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function.
- Product
- the 'id' parameter in the 'get_view' function
- Fixed in
- 2.5.25
- What to do
- Update the 'id' parameter in the 'get_view' function to 2.5.25 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 1, 2024Html5 Video Player: Does not sanitise and escape some of its player settingsCVE-2023-6485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
- Product
- Html5 Video Player
- Fixed in
- 2.5.19
- What to do
- Update Html5 Video Player to 2.5.19 or newer.
Dec 15, 2023HDW Player Plugin (Video Player & Video Gallery): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49178 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr. Hdwplayer HDW Player Plugin (Video Player & Video Gallery) allows Reflected XSS.This issue affects HDW Player Plugin (Video Player & Video Gallery): from n/a through 5.0.
- Product
- HDW Player Plugin (Video Player & Video Gallery)
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update HDW Player Plugin (Video Player & Video Gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 24, 2023FV Flowplayer Video Player: Stored Cross-Site ScriptingCVE-2023-4520 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_fv_player_user_video’ parameter saved via the 'save' function hooked via init, and the plugin is also vulnerable to Arbitrary Usermeta Update via the 'save' function in versions up to, and including, 7.5.37.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, and makes it possible to update the user metas arbitrarily, but the meta value can only be a string.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.37.7212
- What to do
- Affects up to 7.5.37.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.CVE-2023-25066 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.
- Affected
- up to 7.5.30.7212
- What to do
- Affects up to 7.5.30.7212. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2022Flowplayer Video Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3984 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Flowplayer Video Player
- Fixed in
- 1.0.5
- What to do
- Update Flowplayer Video Player to 1.0.5 or newer.
Dec 19, 2022Easy Video Player: Does not sanitize and escapes some parametersCVE-2022-3937 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Easy Video Player
- Fixed in
- 1.2.2.3
- What to do
- Update Easy Video Player to 1.2.2.3 or newer.
Apr 4, 2022FV Flowplayer Video Player: Authenticated Persistent Cross-Site Scripting (XSS)CVE-2022-25613 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.18.727
- What to do
- Affects up to 7.5.18.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 18, 2022Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727)CVE-2022-25607 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).
- Affected
- up to 7.5.15.727
- What to do
- Affects up to 7.5.15.727. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 25, 2021Video Player for YouTube: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Video Player for YouTube
- Fixed in
- 1.4
- What to do
- Update Video Player for YouTube to 1.4 or newer.
Oct 6, 2021FV Flowplayer Video Player: Reflected Cross-Site ScriptingCVE-2021-39350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
- Product
- FV Flowplayer Video Player
- Affected
- 7.5.0.727 to 7.5.2.727
- What to do
- Affects 7.5.0.727 to 7.5.2.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 15, 2021Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authentCVE-2020-35748 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
- Product
- Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player
- Fixed in
- 7.4.37.727
- What to do
- Update Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player to 7.4.37.727 or newer.
Full record and what to do →NVD recorddocs.google.comgithub.com
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.3.15.727
- What to do
- Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.CVE-2019-14801 · WordPress plugins & themes · reported by MITRECritical 9.8
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.3.15.727
- What to do
- Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 9, 2019The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.CVE-2019-14799 · WordPress plugins & themes · reported by MITREMedium 6.1
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
- Product
- FV Flowplayer Video Player
- Fixed in
- 7.3.14.727
- What to do
- Update FV Flowplayer Video Player to 7.3.14.727 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jul 17, 2019A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress.CVE-2019-13573 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
- Product
- A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player
- Fixed in
- 7.3.19.727
- What to do
- Update A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player to 7.3.19.727 or newer.
Full record and what to do →NVD recordfortiguard.complugins.trac.wordpress.org
Sep 7, 2018FV Flowplayer Video Player 6.1.2 to 6.6.4: Cross-site scriptingCVE-2018-0642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- FV Flowplayer Video Player 6.1.2 to 6.6.4
- Affected
- 6.1.2 to 6.6.4
- What to do
- Affects 6.1.2 to 6.6.4. Update FV Flowplayer Video Player 6.1.2 to 6.6.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2014Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attaCVE-2014-8584 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player)
- Fixed in
- 1.5.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Web Dorado Spider Video Player (aka WordPress Video Player) to 1.5.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress aCVE-2014-4534 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.
- Product
- HTML5 Video Player with Playlist
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update HTML5 Video Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Apr 11, 2014Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of adCVE-2013-2706 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Stream Video Player plugin 1.4.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors.
- Product
- Stream Video Player
- What to do
- Update Stream Video Player to the newest version.
May 10, 2013SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commCVE-2013-3532 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.
- Product
- Web Dorado Spider Video Player
- What to do
- Update Web Dorado Spider Video Player to the newest version.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.