CVE-2026-85347: fallo en FV Flowplayer Video Player
FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
0Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Track
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
Productos afectados
Unknown · FV Flowplayer Video PlayerCVEs relacionadas — FV Flowplayer Video Player
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-85345MEDIUMFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataEPSS 0.2%CVE-2026-108068LOWFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardEPSS 0.1%CVE-2026-108067LOWFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOREPSS 0.1%CVE-2026-85351—FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportEPSS —CVE-2026-85346—FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser HandlersEPSS —