FV Flowplayer Video Player vulnerabilities | LiveThreat CVE Feed

Product

FV Flowplayer Video Player

by foliovision · last CVE Oct 14, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Severity mix

Critical 2High 6Medium 13Low 0

Severity

Exploitation

Watch

Add FV Flowplayer Video Player to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-86461	8.8	1%	Oct 14	FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter Affected: through 7.5.54.7212
CVE-2024-6338	8.8	1%	Jul 19	The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to… Affected: before 7.5.47.7212
CVE-2023-25066	8.8	0%	Feb 14	Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions Affected: through 7.5.30.7212
CVE-2026-97398	7.2	0%	Oct 14	FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute Affected: through 7.5.54.7212
CVE-2026-7556	7.2	0%	Jun 9	FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text Affected: through 7.5.49.7212
CVE-2022-25607	7.2	1%	Mar 18	Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727) Affected: through 7.5.15.727