Skip to content
OpenAdvisories

Vendor

foliovision

34 known vulnerabilities.

Products

FV Flowplayer Video Player 22 FV Player 8 3 FV Flowplayer Video Player (WordPress plugin) 2 FV Simpler SEO 2 FV Antispam 1 Filled In 1 FV Thoughtful Comments 1 Foliopress WYSIWYG 1 FV Descriptions 1
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.1
    CVE-2026-121764

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

    foliovision FV Flowplayer Video Player
  • High 7.2
    CVE-2026-118079

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

    foliovision FV Flowplayer Video Player
  • High 8.8
    CVE-2026-86461

    FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function…

    foliovision FV Flowplayer Video Player Web / CMS
  • High 7.2
    CVE-2026-97398

    FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it pos…

    foliovision FV Flowplayer Video Player Web / CMS
  • High 7.1
    CVE-2026-42699

    WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

    foliovision FV Player 8
  • High 8.8
    CVE-2026-83526

    FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

    The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype function. This is due to insufficient file type validation in check_mimetype(), which writes attacker-supplied remot…

    foliovision FV Player 8 Web / CMS
  • High 7.2
    CVE-2026-7556

    FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unau…

    foliovision FV Flowplayer Video Player Web / CMS
  • High 7.1
    CVE-2025-66102

    WordPress FV Antispam plugin <= 2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FV Antispam: from n/a through <= 2.7.

    foliovision FV Antispam
  • High 7.1
    CVE-2025-32610

    WordPress Foliopress WYSIWYG plugin <= 2.6.18 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Foliopress WYSIWYG: from n/a through <= 2.6.18.

    foliovision Foliopress WYSIWYG
  • High 7.1
    CVE-2025-22628

    WordPress Filled In Plugin <= 1.9.2 - CSRF to Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.

    foliovision Filled In
  • High 7.1
    CVE-2024-56032

    WordPress FV Descriptions plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Descriptions fv-descriptions allows Reflected XSS.This issue affects FV Descriptions: from n/a through <= 1.4.

    foliovision FV Descriptions
  • High 8.8
    CVE-2024-6338

    FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter

    The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient prep…

    foliovision FV Flowplayer Video Player Web / CMS
  • High 7.1
    CVE-2024-35631

    WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Foliovision FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.45.7212.

    foliovision FV Flowplayer Video Player
  • High 7.1
    CVE-2023-30499

    WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.

    foliovision FV Flowplayer Video Player