Non notée
CVE-2026-85344 FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization
Description
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| FV Flowplayer Video Player 7.5 | premières → < 7.5.57.7212 | 7.5.57.7212 |
Autres CVE de FV Flowplayer Video Player
Les 8 CVE de FV Flowplayer Video Player →
CVE-2026-117525
FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup
7.5
Élevée
CVE-2026-85351
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
5.0
Moyenne
CVE-2026-85347
FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
6.8
Moyenne
CVE-2026-85346
FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers
4.3
Moyenne