Not rated
CVE-2026-85344 FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FV Flowplayer Video Player 7.5 | earliest → < 7.5.57.7212 | 7.5.57.7212 |
Other CVEs of FV Flowplayer Video Player
The 8 CVEs of FV Flowplayer Video Player →
CVE-2026-117525
FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup
7.5
High
CVE-2026-85351
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
5.0
Medium
CVE-2026-85347
FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
6.8
Medium
CVE-2026-85346
FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers
4.3
Medium