Stored Cross-Site Scripting and Arbitrary Usermeta Update in FV Flowplayer Video Player Plugin

CVE-2023-4520

Summary

The FV Flowplayer Video Player plugin for WordPress is susceptible to Stored Cross-Site Scripting via the '_fv_player_user_video' parameter, which can be manipulated by unauthenticated attackers. This vulnerability stems from inadequate input sanitization and output escaping within the 'save' function hooked to 'init'. Attackers can inject malicious web scripts that execute when users access affected pages, posing a significant risk to user data integrity. Additionally, the plugin is vulnerable to Arbitrary Usermeta Update, allowing attackers to alter user meta information, though the meta value is restricted to strings. This can compromise user accounts and disrupt user experience.

References