PT-2021-22556 · WordPress · Fv Flowplayer Video Player

Margaux Dabert · Published 2021-10-06 · Updated 2025-02-14 · CVE-2021-39350

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: FV Flowplayer Video Player WordPress plugin versions 7.5.0.727 through 7.5.2.727

Description: The issue allows attackers to inject arbitrary web scripts via the player id parameter found in the ~/view/stats.php file, enabling Reflected Cross-Site Scripting attacks.

Recommendations: For versions 7.5.0.727 through 7.5.2.727, consider disabling access to the ~/view/stats.php file or restricting the use of the player id parameter until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-39350

Affected Products

Fv Flowplayer Video Player

References · 6

• https://plugins.trac.wordpress.org/changeset/2580834/fv-wordpress-flowplayer/trunk/view/stats.php · Patch
• https://osv.dev/vulnerability/CVE-2021-39350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39350 · Security Note
• https://t.me/cvenotify/111464 · Telegram Post
• https://t.me/cibsecurity/30074 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39350 · Note