Cross-Site Scripting in FV Flowplayer Video Player for WordPress
CVE-2020-35748

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Fv FloWPlayer Video Player
Vendor
CVE Published:
15 January 2021

What is CVE-2020-35748?

The FV Flowplayer Video Player plugin for WordPress is susceptible to a Cross-Site Scripting (XSS) vulnerability that allows an authenticated remote user to inject arbitrary web scripts or HTML. This vulnerability resides in the models/list-table.php file, specifically within the fv_wp_fvvideoplayer_src JSON field in the data parameter. Exploitation of this vulnerability could lead to unauthorized actions on behalf of users, making it crucial for site administrators to apply the latest updates to safeguard their WordPress sites.

References

https://github.com/arkango/
x_refsource_MISC
https://docs.google.com/document/d/1xUTEmWqfy3u3KBSTjxCAG...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
The Cyber Security Vulnerability Database.