FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
medium
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inj...
- CVSS:
- 6.4
(Wordfence)
- Affected:
- up to 8.1.7
- Fixed in:
- 8.1.8
- Disclosed:
- Oct 13, 2026
CVE-2026-95807 on NVD →
FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
high
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remote file content to the public uploads directory before any MIM...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 8.1.7
- Fixed in:
- 8.1.8
- Disclosed:
- Oct 9, 2026
CVE-2026-83526 on NVD →
FV Player 8 <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting
high
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.1.8. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a us...
- CVSS:
- 7.2
(Wordfence)
- Affected:
- up to 8.1.8
- Fixed in:
- 8.1.9
- Disclosed:
- Oct 6, 2026
CVE-2026-42699 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database