Stored Cross-Site Scripting in FV Flowplayer Video Player WordPress Plugin

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212. It occurs because user-supplied input in the Text Lightbox Caption feature is not properly sanitized or escaped. Users with the Contributor role or higher can inject malicious scripts into a page.

Useful 0 Not Useful 0

Detection Guidance

Check your WordPress plugins for the FV Flowplayer Video Player version. Run commands like 'wp plugin list' in the WordPress directory or inspect the plugin files for version details. Look for versions prior to 7.5.56.7212.

Useful 0 Not Useful 0

Impact Analysis

When a higher-privileged user views the affected page, the injected script executes. This could lead to unauthorized actions, data theft, or other malicious activities depending on the privileges of the affected user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized script execution, potentially enabling attackers to steal sensitive data or perform actions on behalf of users. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update the FV Flowplayer Video Player plugin to version 7.5.56.7212 or later immediately. Remove or disable the plugin if updating is not possible. Restrict user roles to minimize exposure.

Useful 0 Not Useful 0