4.1 Medium

CVE-2022-25613 Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin)…

Description

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.

Affected products and versions

Product	Affected versions	Fixed in
FV Flowplayer Video Player (WordPress plugin) 7.5	earliest → 7.5.18.727	No fix stated

The 2 CVEs of FV Flowplayer Video Player (WordPress plugin) →

CVE-2022-25607 Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player… 6.6 Medium

Do you use FV Flowplayer Video Player (WordPress plugin)?

Track this CVE Watch FV Flowplayer Video Player (WordPress plugin) Check my SBOMs

www.cveye.io/en/cve/CVE-2022-25613

Timeline

Published April 4, 2022
Last modified April 28, 2026

References

wordpress.org wordpress.org
patchstack.com patchstack.com

Track this CVE

CVE-2022-25613 Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin)…

Description

Affected products and versions

Other CVEs of FV Flowplayer Video Player (WordPress plugin)