CVE-2026-117525highCWE-79

CVE-2026-117525: falha de alta gravidade em FV Flowplayer Video Player

FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

Publicada em

Seguir esta CVE+ Monitorar FV Flowplayer Video Player

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7.5epss 0.3%
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · FV Flowplayer Video Player
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — FV Flowplayer Video Player

No mesmo produto, das mais perigosas para as menos.

CVE-2026-85347MEDIUMFV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox CaptionEPSS 0.2%CVE-2026-85345MEDIUMFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataEPSS 0.2%CVE-2026-108068LOWFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardEPSS 0.2%CVE-2026-108067LOWFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOREPSS 0.2%CVE-2026-85351MEDIUMFV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportEPSS 0.2%CVE-2026-85344MEDIUMFV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationEPSS 0.2%