CVE-2026-117525highCWE-79

CVE-2026-117525: fallo de gravedad alta en FV Flowplayer Video Player

FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

Publicada el

Seguir esta CVE+ Monitorear FV Flowplayer Video Player

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7.5epss 0.3%
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Unknown · FV Flowplayer Video Player
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — FV Flowplayer Video Player

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-85347MEDIUMFV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox CaptionEPSS 0.2%CVE-2026-85345MEDIUMFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataEPSS 0.2%CVE-2026-108068LOWFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardEPSS 0.2%CVE-2026-108067LOWFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOREPSS 0.2%CVE-2026-85351MEDIUMFV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportEPSS 0.2%CVE-2026-85344MEDIUMFV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationEPSS 0.2%