WordPress Plugin Vulnerabilities

FV Flowplayer Video Player < 7.5.3.727 - Reflected Cross-Site Scripting

Description

The plugin does not escape or validate the player_id parameter before outputting back in the Stats page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Proof of Concept

https://example.com/wp-admin/admin.php?page=fv_player_stats&player_id=1+%3Csvg%2Fonload%3Dalert%28%2FXSS%2F%29%3E

Affects Plugins

Plugin icon
fv-wordpress-flowplayer
Fixed in 7.5.3.727

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
e9adc166-be7f-4066-a2c1-7926c6304fc9

Timeline

Publicly Published
2021-08-11 (about 2 years ago)
Added
2021-08-11 (about 2 years ago)
Last Updated
2021-08-11 (about 2 years ago)

Other

Published
Title
Published
2022-12-07
Title
WP Social Sharing <= 2.2 - Admin+ Stored XSS
Published
2024-04-25
Title
Happy Addons for Elementor < 3.10.7 - Contributor+ Stored Cross-Site Scripting
Published
2022-04-06
Title
Content Egg < 5.3.0 - Reflected Cross-Site Scripting
Published
2016-01-27
Title
IMPress Listings <= 2.0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2016-11-19
Title
WP Canvas - Shortcodes < 2.07 - Authenticated Stored Cross-Site Scripting (XSS)