Cross-Site Scripting Vulnerability in FV Flowplayer Video Player by WordPress
CVE-2018-0642

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Fv FloWPlayer Video Player
Vendor
CVE Published:
7 September 2018

What is CVE-2018-0642?

An identified vulnerability in the FV Flowplayer Video Player, affecting versions 6.1.2 through 6.6.4, allows remote attackers to exploit cross-site scripting (XSS) weaknesses. This can enable them to inject arbitrary web scripts or HTML via unvalidated inputs, posing significant security risks to user data and site integrity. Proper input validation and security measures are necessary to mitigate these risks and protect vulnerable installations.

Affected Version(s)

FV Flowplayer Video Player 6.1.2 to 6.6.4

References

https://wordpress.org/plugins/fv-wordpress-flowplayer/#de...
x_refsource_CONFIRM
http://jvn.jp/en/jp/JVN70246549/index.html
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.