Cross-Site Scripting
17 records63%First: 2011. Latest: 2026.
Plugin security history
FV Flowplayer Video Player Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 27 vulnerability records associated with FV Flowplayer Video Player, published between 2011 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
27Total records
3Critical
3High
21Medium
0Low
0Informational
27Patched records
0Currently marked unpatched
2011-07-22First disclosure
2026-06-30Latest disclosure
23 of 27CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2011 | 1 | |
| 2015 | 1 | |
| 2018 | 2 | |
| 2019 | 6 | |
| 2021 | 2 | |
| 2022 | 2 | |
| 2023 | 3 | |
| 2024 | 7 | |
| 2026 | 3 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 3 | 11.1% |
| High | 3 | 11.1% |
| Medium | 21 | 77.8% |
Vulnerability-Type Breakdown
SQL Injection
5 records18.5%First: 2019. Latest: 2024.
Information Disclosure
2 records7.4%First: 2019. Latest: 2019.
Other
2 records7.4%First: 2024. Latest: 2024.
CSRF
1 record3.7%First: 2023. Latest: 2023.
Patch Status
- Patched
- 27
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
7.5.52.72127.5.50.72127.5.51.72127.5.48.72127.5.47.72127.5.46.72127.5.45.72127.5.44.72127.5.39.72127.5.35.72127.5.31.72127.5.19.7287.5.18.7277.5.3.7277.4.38.7277.3.19.7277.3.14.7277.3.15.7277.2.1.7276.6.56.0.3.41.2.12
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-7.5.51.7212 | FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode | June 30, 2026 | 7.5.52.7212 | Medium |
*-7.5.49.7212 | FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text | June 8, 2026 | 7.5.50.7212 | High |
[*, 7.5.51.7212) | FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting | June 4, 2026 | 7.5.51.7212 | Medium |
*-7.5.47.7212 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library | December 3, 2024 | 7.5.48.7212 | Medium |
*-7.5.46.7212 | FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter | July 18, 2024 | 7.5.47.7212 | High |
*-7.5.45.7212 | FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting | May 27, 2024 | 7.5.46.7212 | Medium |
*-7.5.43.7212 | FV Flowplayer Video Player <= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery | April 22, 2024 | 7.5.45.7212 | Medium |
*-7.5.44.7212 | FV Flowplayer Video Player <= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect | April 11, 2024 | 7.5.45.7212 | Medium |
*-7.5.41.7212 | FV Flowplayer Video Player <= 7.5.41.7212 - Reflected Cross-Site Scripting | March 26, 2024 | 7.5.44.7212 | Medium |
*-7.5.41.7212 | FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting | March 16, 2024 | 7.5.44.7212 | Medium |
*-7.5.37.7212 | FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update | August 24, 2023 | 7.5.39.7212 | Medium |
*-7.5.32.7212 | FV Flowplayer Video Player <= 7.5.32.7212 - Reflected Cross-Site Scripting via id | May 3, 2023 | 7.5.35.7212 | Medium |
*-7.5.30.7210 | FV Flowplayer Video Player <= 7.5.30.7210 - Cross-Site Request Forgery | February 2, 2023 | 7.5.31.7212 | Medium |
*-7.5.18.727 | FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting | April 4, 2022 | 7.5.19.728 | Medium |
*-7.5.15.727 | FV Flowplayer Video Player <= 7.5.15.727 - SQL Injection | March 18, 2022 | 7.5.18.727 | High |
7.5.0.727-7.5.2.727 | FV Flowplayer Video Player 7.5.0.727 - 7.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter | October 5, 2021 | 7.5.3.727 | Medium |
*-7.4.37.727 | FV Flowplayer Video Player <= 7.4.37.727 - Authenticated Stored Cross-Site Scripting | January 15, 2021 | 7.4.38.727 | Medium |
*-7.3.18.727 | FV Flowplayer Video Player <= 7.3.18.727 - SQL Injection | July 11, 2019 | 7.3.19.727 | Critical |
*-7.3.13.727 | FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting | May 20, 2019 | 7.3.14.727 | Medium |
[*, 7.3.15.727) | FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection | May 20, 2019 | 7.3.15.727 | Critical |
*-7.3.14.727 | FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Information Exposure | May 20, 2019 | 7.3.15.727 | Medium |
[*, 7.3.15.727) | FV Flowplayer Video Player <= 7.3.14.727 - Unauthenticated SQL Injection | May 16, 2019 | 7.3.15.727 | Critical |
[*, 7.3.15.727) | FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Data Exposure | May 16, 2019 | 7.3.15.727 | Medium |
*-7.2.0.727 | FV Flowplayer Video Player <= 7.2.0.727 - Reflected Cross-Site Scripting | September 21, 2018 | 7.2.1.727 | Medium |
6.1.2-6.6.4 | FV Flowplayer Video Player 6.1.2 - 6.6.4 - Cross-Site Scripting | July 2, 2018 | 6.6.5 | Medium |
Selected source records
Latest Records
MediumCVE-2026-12135
FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode
Published: June 30, 2026
- Affected versions
- *-7.5.51.7212
- Patched versions
- 7.5.52.7212
HighCVE-2026-7556
FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
Published: June 8, 2026
- Affected versions
- *-7.5.49.7212
- Patched versions
- 7.5.50.7212
MediumCVE-2026-49773
FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published: June 4, 2026
- Affected versions
- [*, 7.5.51.7212)
- Patched versions
- 7.5.51.7212
MediumCVE-2024-5020
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
Published: December 3, 2024
- Affected versions
- *-2.4.8
- Patched versions
- 2.4.9
- Affected versions
- *-4.1.1
- Patched versions
- 4.1.2
- Affected versions
- *-1.9.12
- Patched versions
- 1.9.13
- Affected versions
- *-7.5.47.7212
- Patched versions
- 7.5.48.7212
- Affected versions
- *-1.8.15
- Patched versions
- 1.8.16
- Affected versions
- *-1.0.286
- Patched versions
- 1.0.288
- Affected versions
- *-3.3.9
- Patched versions
- 3.3.10
- Affected versions
- *-2.0.11
- Patched versions
- 2.0.12
- Affected versions
- *-2.3.3
- Patched versions
- 2.3.4
- Affected versions
- *-4.3.1
- Patched versions
- 4.3.2
- Affected versions
- *-3.3.4
- Patched versions
- 3.3.5
- Affected versions
- *-2.6.8
- Patched versions
- 2.6.9
- Affected versions
- *-1.15.27
- Patched versions
- 1.15.28
- Affected versions
- *-3.59.4
- Patched versions
- 3.59.5
- Affected versions
- *-6.6.2
- Patched versions
- Not supplied
HighCVE-2024-6338
FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
Published: July 18, 2024
- Affected versions
- *-7.5.46.7212
- Patched versions
- 7.5.47.7212
MediumCVE-2024-35631
FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting
Published: May 27, 2024
- Affected versions
- *-7.5.45.7212
- Patched versions
- 7.5.46.7212
MediumCVE-2024-32955
FV Flowplayer Video Player <= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery
Published: April 22, 2024
- Affected versions
- *-7.5.43.7212
- Patched versions
- 7.5.45.7212
MediumCVE-2024-32078
FV Flowplayer Video Player <= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect
Published: April 11, 2024
- Affected versions
- *-7.5.44.7212
- Patched versions
- 7.5.45.7212
Highest-Severity Records
CriticalCVE-2019-13573
FV Flowplayer Video Player <= 7.3.18.727 - SQL Injection
Published: July 11, 2019
- Affected versions
- *-7.3.18.727
- Patched versions
- 7.3.19.727
CriticalCVE-2019-14801
FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection
Published: May 20, 2019
- Affected versions
- [*, 7.3.15.727)
- Patched versions
- 7.3.15.727
Critical
FV Flowplayer Video Player <= 7.3.14.727 - Unauthenticated SQL Injection
Published: May 16, 2019
- Affected versions
- [*, 7.3.15.727)
- Patched versions
- 7.3.15.727
HighCVE-2024-6338
FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
Published: July 18, 2024
- Affected versions
- *-7.5.46.7212
- Patched versions
- 7.5.47.7212
HighCVE-2022-25607
FV Flowplayer Video Player <= 7.5.15.727 - SQL Injection
Published: March 18, 2022
- Affected versions
- *-7.5.15.727
- Patched versions
- 7.5.18.727
HighCVE-2026-7556
FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
Published: June 8, 2026
- Affected versions
- *-7.5.49.7212
- Patched versions
- 7.5.50.7212
MediumCVE-2024-29122
FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: March 16, 2024
- Affected versions
- *-7.5.41.7212
- Patched versions
- 7.5.44.7212
MediumCVE-2020-35748
FV Flowplayer Video Player <= 7.4.37.727 - Authenticated Stored Cross-Site Scripting
Published: January 15, 2021
- Affected versions
- *-7.4.37.727
- Patched versions
- 7.4.38.727
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.