CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-14799 – FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-14799
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. El plugin FV Flowplayer Video Player en versiones anteriores a 7.3.14.727 para WordPress, permite un ataque de tipo XSS en la suscripción de correo electrónico. • https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers https://wpvulndb.com/vulnerabilities/9278 https://www.pluginvulnerabilities.com/2019/05/15/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2019-14800 – FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Information Exposure
https://notcve.org/view.php?id=CVE-2019-14800
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI. El plugin FV Flowplayer Video Player versiones anteriores a 7.3.15.727 para WordPress, permite a invitados obtener la lista de suscripción de correo electrónico en formato CSV por medio del URI wp-admin/admin-post.php?Page=fvplayer&fv-email-export=1. • https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers https://www.pluginvulnerabilities.com/2019/05/15/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0642 – FV Flowplayer Video Player 6.1.2 - 6.6.4 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-0642
Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en FV Flowplayer Video Player, de la versión 6.1.2 a la 6.6.4, permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante vectores sin especificar. • http://jvn.jp/en/jp/JVN70246549/index.html https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2014-1232 – Foliopress WYSIWYG < 2.6.8.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-1232
Cross-site scripting (XSS) vulnerability in the Foliopress WYSIWYG plugin before 2.6.8.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Cross-site scripting (XSS) en el plugin Foliopress WYSIWYG para WordPress anterior a 2.6.8.5 que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://secunia.com/advisories/56261 http://wordpress.org/plugins/foliopress-wysiwyg/changelog http://www.securityfocus.com/bid/64666 https://exchange.xforce.ibmcloud.com/vulnerabilities/90102 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 0CVE-2011-4568 – FV Flowplayer Video Player <= 1.2.11 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-4568
Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en view/frontend-head.php en el complemento Flowplayer antes de v1.2.12 para WordPress, permite a atacantes remotos ejecutar secuencias de comandos web o HTML a través de la URI. • http://plugins.trac.wordpress.org/changeset?reponame=&new=413607%40fv-wordpress-flowplayer&old=409594%40fv-wordpress-flowplayer http://secunia.com/advisories/46346 http://wordpress.org/extend/plugins/fv-wordpress-flowplayer/changelog http://www.securityfocus.com/bid/50008 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •