Skip to content
Sign in
5.0 Medium

CVE-2026-85351 FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import

Description

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None

Affected products and versions

Product Affected versions Fixed in
FV Flowplayer Video Player 7.5 earliest → < 7.5.56.7212 7.5.56.7212

Other CVEs of FV Flowplayer Video Player

The 6 CVEs of FV Flowplayer Video Player →
CVE-2026-85347 FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption 6.8 Medium CVE-2026-85346 FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers 4.3 Medium CVE-2026-108068 FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard 3.8 Low CVE-2026-108067 FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR 3.8 Low
Track this CVE