CVE-2020-35748
Medium
Description
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
SeverityMedium
CVSS5.4
Exploit probability—
ProductFoliovision Fv Flowplayer Video Player
PublishedJan 15, 2021
First seenJan 15, 2021
How to fix
Update
- foliovision fv_flowplayer_video_player7.4.37.727 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| foliovision fv_flowplayer_video_player | v < 7.4.37.727 | 7.4.37.727 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.