These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient exten [truncated]
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially leading to XSS attacks when users access affected pages. The 'Par [truncated]
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in versions up to and including 8.1.7. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability [truncated]
A Cross Site Scripting (XSS) vulnerability exists in the WordPress FV Simpler SEO plugin versions up to 1.9.7, allowing for Stored XSS. This issue potentially impacts users who interact with affected pages. Defenders responsible for WordPress installations with the FV Simpler SEO plugin, particularly those with user-generated content or public-facing sites, should assess exposure and prioritize updates. T [truncated]
The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7. This vulnerability allows authenticated attackers with subscriber-level access and above to upload files that may be executable, potentially leading to remote code execution. The vulnerability is caused by insufficient file type validation in the check_mimetype() function, which writes [truncated]
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unquoted popup shortcode attribute in all versions up to, and including, 7.5.54.7212. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages, which will execute when a user accesses an injected page. Successful exploitation req [truncated]
The CVE-2026-42695 vulnerability is a Cross-Site Scripting (XSS) issue in the FV Flowplayer Video Player plugin for WordPress, affecting versions up to 7.5.54.7212. This vulnerability allows for Stored XSS, which can be exploited by an attacker with low privileges. The issue has been publicly disclosed and is considered to have a medium severity with a CVSS score of 6.5.
A Subscriber Cross Site Scripting (XSS) vulnerability exists in FV Flowplayer Video Player versions before 7.5.51.7212. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. It was published on 2026-06-15T21:17:22.173Z and last modified on 2026-06-15T21:24:32.790Z.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an [truncated]
