Description

WordPress Plugin FV Flowplayer Video Player is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin FV Flowplayer Video Player version 7.5.30.7210 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 7.5.31.7212 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fv-wordpress-flowplayer/fv-flowplayer-video-player-7531-cross-site-request-forgery

https://plugins.svn.wordpress.org/fv-wordpress-flowplayer/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin PowerPress Podcasting by Blubrry SQL Injection (6.0.2)

WordPress Plugin SpiderCatalog Unspecified Vulnerability (1.6.8)

WordPress Plugin Billplz for WooCommerce Unspecified Vulnerability (3.10)

WordPress Plugin Broken Link Checker Cross-Site Scripting (1.10.4)

WordPress Plugin RK Responsive Contact Form SQL Injection (1.0.0)

Severity

High

Classification

CVE-2023-25066 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update CSRF