PLUGIN SECURITY
Is FV Flowplayer Video Player safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the FV Flowplayer Video Player WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
fv-wordpress-flowplayer
Maintenance status
Known vulnerabilities
41 known CVEs on file for FV Flowplayer Video Player. Reported between 2011 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-85344 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212 | Missing Authorization | Medium 4.3 | < 7.5.57.7212 | 7.5.57.7212 | 2026-11-08 | — |
| CVE-2026-117525 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.5 | < 7.5.57.7212 | 7.5.57.7212 | 2026-11-07 | — |
| CVE-2026-121764 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 7.5.57.7212 | 7.5.57.7212 | 2026-11-06 | — |
| CVE-2026-85351 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Server-Side Request Forgery (SSRF) | Unknown | < 7.5.56.7212 | 7.5.56.7212 | 2026-11-05 | — |
| CVE-2026-85347 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 7.5.56.7212 | 7.5.56.7212 | 2026-11-05 | — |
| CVE-2026-85346 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Cross-Site Request Forgery (CSRF) | Unknown | < 7.5.56.7212 | 7.5.56.7212 | 2026-11-05 | — |
| CVE-2026-108068 | FV Flowplayer Video Player [fv-wordpress-flowplayer] >= 7.4.44.727 - < 7.5.56.7212 | Missing Authorization | Unknown | 7.4.44.727–7.5.56.7212 | 7.5.56.7212 | 2026-11-04 | — |
| CVE-2026-108067 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Authorization Bypass Through User-Controlled Key | Unknown | < 7.5.56.7212 | 7.5.56.7212 | 2026-11-04 | — |
+ 53 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-121515 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.57.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.5.57.7212 | 7.5.57.7212 | 2026-11-04 | — |
| CVE-2026-110533 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.5.56.7212 | 7.5.56.7212 | 2026-10-30 | — |
| CVE-2026-110001 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.5.56.7212 | 7.5.56.7212 | 2026-10-30 | — |
| CVE-2026-109984 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.56.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.5.56.7212 | 7.5.56.7212 | 2026-10-30 | — |
| CVE-2026-118079 | FV Flowplayer Video Player [fv-wordpress-flowplayer] <= 8.3.4 (unfixed) | Deserialization of Untrusted Data | High 7.2 | < 8.3.4 | 8.3.4 | 2026-10-29 | — |
| CVE-2026-85345 | FV Flowplayer Video Player [fv-wordpress-flowplayer] >= 7.5.44.7212 - < 7.5.55.7212 | Server-Side Request Forgery (SSRF) | Unknown | 7.5.44.7212–7.5.55.7212 | 7.5.55.7212 | 2026-10-14 | — |
| CVE-2026-86461 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.55.7212 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 7.5.55.7212 | 7.5.55.7212 | 2026-10-13 | — |
| CVE-2026-42695 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.55.7212 | — | Medium 6.5 | < 7.5.55.7212 | 7.5.55.7212 | 2026-10-09 | — |
| CVE-2026-97398 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.55.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 7.5.55.7212 | 7.5.55.7212 | 2026-10-09 | — |
| CVE-2026-97630 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.55.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.5.55.7212 | 7.5.55.7212 | 2026-10-06 | — |
| CVE-2026-12135 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.52.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.5.52.7212 | 7.5.52.7212 | 2026-06-30 | — |
| CVE-2026-7556 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.50.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 7.5.50.7212 | 7.5.50.7212 | 2026-06-08 | — |
| CVE-2026-49773 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.51.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 7.5.51.7212 | 7.5.51.7212 | 2026-06-04 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.48.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 7.5.48.7212 | 7.5.48.7212 | 2024-12-03 | — |
| CVE-2024-6338 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.47.7212 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 7.5.47.7212 | 7.5.47.7212 | 2024-07-18 | — |
| CVE-2024-35631 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.46.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 7.5.46.7212 | 7.5.46.7212 | 2024-05-27 | — |
| CVE-2024-32955 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.45.7212 | Server-Side Request Forgery (SSRF) | Medium 4.9 | < 7.5.45.7212 | 7.5.45.7212 | 2024-04-22 | — |
| CVE-2024-32078 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.45.7212 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 4.1 | < 7.5.45.7212 | 7.5.45.7212 | 2024-04-11 | — |
| CVE-2024-22299 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.44.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 7.5.44.7212 | 7.5.44.7212 | 2024-03-26 | — |
| CVE-2024-29122 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.44.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 7.5.44.7212 | 7.5.44.7212 | 2024-03-16 | — |
| CVE-2023-4520 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.39.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 7.5.39.7212 | 7.5.39.7212 | 2023-08-24 | — |
| CVE-2023-30499 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.35.7212 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 7.5.35.7212 | 7.5.35.7212 | 2023-05-03 | — |
| CVE-2023-25066 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.31.7212 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 7.5.31.7212 | 7.5.31.7212 | 2023-02-02 | — |
| CVE-2022-25613 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.19.728 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.5.19.728 | 7.5.19.728 | 2022-04-04 | — |
| CVE-2022-25607 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.18.727 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 7.5.18.727 | 7.5.18.727 | 2022-03-18 | — |
| CVE-2021-39350 | FV Flowplayer Video Player [fv-wordpress-flowplayer] >= 7.5.0.727 - <= 7.5.2.727 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | 7.5.0.727–7.5.2.727 | 7.5.2.727 | 2021-10-05 | — |
| CVE-2020-35748 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.4.37.727 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 7.4.38.727 | 7.4.38.727 | 2021-01-15 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.19.727 | — | Unknown | < 7.3.19.727 | 7.3.19.727 | 2019-07-13 | — |
| CVE-2019-13573 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.19.727 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 7.3.19.727 | 7.3.19.727 | 2019-07-11 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | — | Unknown | < 7.3.15.727 | 7.3.15.727 | 2019-05-21 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | — | Unknown | < 7.3.15.727 | 7.3.15.727 | 2019-05-21 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.14.727 | — | Unknown | < 7.3.14.727 | 7.3.14.727 | 2019-05-21 | — |
| CVE-2019-14800 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 7.3.15.727 | 7.3.15.727 | 2019-05-20 | — |
| CVE-2019-14799 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.14.727 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 7.3.14.727 | 7.3.14.727 | 2019-05-20 | — |
| CVE-2019-14801, CVE-2019-14800 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 7.3.15.727 | 7.3.15.727 | 2019-05-20 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | — | Unknown | < 7.3.15.727 | 7.3.15.727 | 2019-05-16 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | — | Unknown | < 7.3.15.727 | 7.3.15.727 | 2019-05-16 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.2.1.727 | — | Unknown | < 7.2.1.727 | 7.2.1.727 | 2018-10-03 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.2.1.727 | — | Unknown | < 7.2.1.727 | 7.2.1.727 | 2018-09-21 | — |
| CVE-2018-0642 | FV Flowplayer Video Player [fv-wordpress-flowplayer] >= 6.1.2 - <= 6.6.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | 6.1.2–6.6.5 | 6.6.5 | 2018-07-02 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 6.0.3.4 | — | Unknown | < 6.0.3.4 | 6.0.3.4 | 2015-08-24 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 6.0.3.4 | — | Unknown | < 6.0.3.4 | 6.0.3.4 | 2015-08-24 | — |
| CVE-2011-4568 | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 1.2.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 1.2.12 | 1.2.12 | 2011-07-22 | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.5.3.727 | — | Unknown | < 7.5.3.727 | 7.5.3.727 | — | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.3.15.727 | — | Unknown | < 7.3.15.727 | 7.3.15.727 | — | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 7.2.1.727 | — | Unknown | < 7.2.1.727 | 7.2.1.727 | — | — |
| — | FV Flowplayer Video Player [fv-wordpress-flowplayer] < 6.0.3.4 | — | Unknown | < 6.0.3.4 | 6.0.3.4 | — | — |
| — | FV Flowplayer Video Player <= 6.0.3.3 - Authenticated Stored Cross-Site Scripting (XSS) | — | Unknown | < 6.0.3.4 | 6.0.3.4 | — | — |
| — | FV Flowplayer Video Player < 7.2.1.727 - Authenticated Cross-Site Scripting (XSS) | — | Unknown | < 7.2.1.727 | 7.2.1.727 | — | — |
| — | FV Flowplayer Video Player < 7.3.15.727 - CSV Export | — | Unknown | < 7.3.15.727 | 7.3.15.727 | — | — |
| — | FV Flowplayer Video Player < 7.5.3.727 - Reflected Cross-Site Scripting | — | Unknown | < 7.5.3.727 | 7.5.3.727 | — | — |
| CVE-2023-4520 | FV Flowplayer Video Player < 7.5.39.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update | — | Unknown | < 7.5.39.7212 | 7.5.39.7212 | — | — |
| CVE-2024-5020 | Multiple Plugins - Contributor+ DOM-Based Stored XSS via FancyBox JavaScript Library | — | Unknown | < 7.5.48.7212 | 7.5.48.7212 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.