WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability
CVE-2022-25607

6.6MEDIUM

Key Information:

Vendor
Wordpress
Status
Fv FloWPlayer Video Player (WordPress Plugin)
Vendor
CVE Published:
18 March 2022

Summary

Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).

Affected Version(s)

FV Flowplayer Video Player (WordPress plugin) <= 7.5.15.727 <= 7.5.15.727

References

https://wordpress.org/plugins/fv-wordpress-flowplayer/#de...
x_refsource_CONFIRM
https://patchstack.com/database/vulnerability/fv-wordpres...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vulnerability discovered by Tien Nguyen Anh (Patchstack Alliance).
.