# FV Flowplayer Video Player

> WordPress's most reliable, easy to use and feature-rich video player. Supports responsive design, HTML5, playlists, ads, stats, Vimeo and YouTube.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:32 UTC.

## Facts (WordPress.org)

- Slug: `fv-wordpress-flowplayer`
- Author: FolioVision
- Version: 7.5.57.7212
- Active installs: 10,000+
- Last update: 2026-11-03 (10 days ago)
- Tested up to: WordPress 6.9.11 (current: 7.1.4)
- Requires: WordPress 3.5, PHP any
- Tags: flowplayer, HTML5 video, mobile video, video player, vimeo
- Page: https://wordpress.org/plugins/fv-wordpress-flowplayer/

## Checks (against WordPress 7.1.4)

- OK: Updated 10 days ago.
- FLAG: Not tested with WordPress 7.1 (tested up to 6.9.11).
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Phones home ↔ Private, Inaccessible ↔ Accessible, Heavy ↔ Light, Behind ↔ Current, Pushy ↔ Fair.

## Known vulnerabilities

- 2026-11-08 MEDIUM: Missing Authorization (before 7.5.57.7212). CVE-2026-85344, https://wpscan.com/vulnerability/2b899f0d-4ebe-4743-820e-32c106cc876a/
- 2026-10-30 MEDIUM: Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments (up to 7.5.55.7212). CVE-2026-109984, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ce7b9d-7284-4a31-b60d-aa66b7871685?source=api-prod
- 2026-10-30 MEDIUM: Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute (up to 7.5.55.7212). CVE-2026-110001, https://www.wordfence.com/threat-intel/vulnerabilities/id/30215025-58d0-48e4-88bd-7ec2b0460c94?source=api-prod
- 2026-10-30 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes (up to 7.5.55.7212). CVE-2026-110533, https://www.wordfence.com/threat-intel/vulnerabilities/id/a24acd18-c94d-4fde-bf6c-7f6b839336d1?source=api-prod
- 2026-10-29 MEDIUM: Authenticated (Shop Manager+) PHP Object Injection (up to 7.5.56.7212). CVE-2026-118079, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3411f3-ca2f-407a-8af5-a6a350d67734?source=api-prod
- 2026-10-14 HIGH: Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (up to 7.5.54.7212). CVE-2026-97398, https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fbb3b-f93f-44da-83fb-f469f541e206?source=api-prod
- 2026-10-14 HIGH: Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter (up to 7.5.54.7212). CVE-2026-86461, https://www.wordfence.com/threat-intel/vulnerabilities/id/3dacc612-5300-497a-9d6a-0944906e180c?source=api-prod
- 2026-10-14 MEDIUM: Authenticated (Contributor+) Server-Side Request Forgery (7.5.44.7212 to 7.5.55.7211). CVE-2026-85345, https://www.wordfence.com/threat-intel/vulnerabilities/id/537a0016-b42d-41b9-bfd2-c34c60f8fa60?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute (up to 7.5.54.7212). CVE-2026-97630, https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc6246e-0a39-431f-a5b1-c1a84c48817b?source=api-prod
- 2026-10-09 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 7.5.54.7212). CVE-2026-42695, https://www.wordfence.com/threat-intel/vulnerabilities/id/08b98e8d-21cc-48e9-8b4e-304cc1168d0f?source=api-prod
- 2026-07-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode (up to 7.5.51.7212). CVE-2026-12135, https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a3a560-08e6-43b7-b953-4e704eafc49b?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (before 7.5.51.7212). CVE-2026-49773, https://www.wordfence.com/threat-intel/vulnerabilities/id/d58fe116-0896-46b5-a120-d0fde9680ff1?source=api-prod
- 2026-06-09 HIGH: Unauthenticated Stored Cross-Site Scripting via Comment Text (up to 7.5.49.7212). CVE-2026-7556, https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd5259-2e35-41f6-b269-5b679e4eaab9?source=api-prod
- 2024-12-03 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (up to 7.5.47.7212). WF-d99d4b9a-aa09-434d-91a8-7afaa0e8b5db-3, https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=api-prod
- 2024-07-18 HIGH: Authenticated (Subscriber+) SQL Injection via exclude Parameter (up to 7.5.46.7212). CVE-2024-6338, https://www.wordfence.com/threat-intel/vulnerabilities/id/d4185a0e-d944-408f-8a43-8f9c6bc3964d?source=api-prod
- 2024-05-27 MEDIUM: Reflected Cross-Site Scripting (up to 7.5.45.7212). CVE-2024-35631, https://www.wordfence.com/threat-intel/vulnerabilities/id/81ac0ec4-8476-4ed5-9b00-a0456afef191?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Subscriber+) Server-side Request Forgery (up to 7.5.43.7212). CVE-2024-32955, https://www.wordfence.com/threat-intel/vulnerabilities/id/e3eec839-9009-48de-80c8-911dc9b545ba?source=api-prod
- 2024-04-11 MEDIUM: Authenticated (Contributor+) Arbitrary Redirect (up to 7.5.44.7212). CVE-2024-32078, https://www.wordfence.com/threat-intel/vulnerabilities/id/360010f3-9053-4c69-a4e8-12f0c77ba746?source=api-prod
- 2024-03-26 MEDIUM: Reflected Cross-Site Scripting (up to 7.5.41.7212). CVE-2024-22299, https://www.wordfence.com/threat-intel/vulnerabilities/id/616b34e8-d853-4176-9fda-427fc9900b97?source=api-prod
- 2024-03-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 7.5.41.7212). CVE-2024-29122, https://www.wordfence.com/threat-intel/vulnerabilities/id/24ebaf12-cf7c-4bc3-b028-27ee4b6b2a45?source=api-prod
- 2023-08-24 MEDIUM: Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update (up to 7.5.37.7212). CVE-2023-4520, https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=api-prod
- 2023-05-03 MEDIUM: Reflected Cross-Site Scripting via id (up to 7.5.32.7212). CVE-2023-30499, https://www.wordfence.com/threat-intel/vulnerabilities/id/9b78834c-cb13-4698-aa19-65f8c6874c8f?source=api-prod
- 2023-02-02 MEDIUM: Cross-Site Request Forgery (up to 7.5.30.7210). CVE-2023-25066, https://www.wordfence.com/threat-intel/vulnerabilities/id/56bbf263-149b-4419-9745-39dc147026a6?source=api-prod
- 2022-04-04 MEDIUM: Stored Cross-Site Scripting (up to 7.5.18.727). CVE-2022-25613, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7aa1f57-44c2-45ec-87a3-483f8dc9a957?source=api-prod
- 2022-03-18 HIGH: SQL Injection (up to 7.5.15.727). CVE-2022-25607, https://www.wordfence.com/threat-intel/vulnerabilities/id/510c26b8-01d6-4d3c-91fd-15963152fdf1?source=api-prod
- 2021-10-05 MEDIUM: Reflected Cross-Site Scripting via player_id Parameter (7.5.0.727 to 7.5.2.727). CVE-2021-39350, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b795352-fad8-485e-bd1b-68c0913555e2?source=api-prod
- 2021-01-15 MEDIUM: Authenticated Stored Cross-Site Scripting (up to 7.4.37.727). CVE-2020-35748, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e28aca-b95f-4041-a1ea-4be84dc55923?source=api-prod
- 2019-07-11 CRITICAL: SQL Injection (up to 7.3.18.727). CVE-2019-13573, https://www.wordfence.com/threat-intel/vulnerabilities/id/232dd4fa-748e-4b65-8b78-7b2d8e9831aa?source=api-prod
- 2019-05-20 MEDIUM: Sensitive Information Exposure (up to 7.3.14.727). CVE-2019-14800, https://www.wordfence.com/threat-intel/vulnerabilities/id/3a337765-b6ea-4c2a-9f1a-e408a9444b88?source=api-prod
- 2019-05-20 CRITICAL: SQL Injection (before 7.3.15.727). CVE-2019-14801, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f301908-d491-492f-9347-432c462de286?source=api-prod
- 2019-05-20 MEDIUM: Unauthenticated Stored Cross-Site Scripting (up to 7.3.13.727). CVE-2019-14799, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcad7322-a5d9-4d72-9983-276f9c05c27d?source=api-prod
- 2019-05-16 MEDIUM: Sensitive Data Exposure (before 7.3.15.727). WF-2b7220a4-7178-42f7-978b-96eae777b134, https://www.wordfence.com/threat-intel/vulnerabilities/id/2b7220a4-7178-42f7-978b-96eae777b134?source=api-prod
- 2019-05-16 CRITICAL: Unauthenticated SQL Injection (before 7.3.15.727). WF-9729ebf5-ef78-4ef4-81d4-165f422c3847, https://www.wordfence.com/threat-intel/vulnerabilities/id/9729ebf5-ef78-4ef4-81d4-165f422c3847?source=api-prod
- 2018-09-21 MEDIUM: Reflected Cross-Site Scripting (up to 7.2.0.727). WF-eb613de8-d298-471f-b585-2da3b5500f10, https://www.wordfence.com/threat-intel/vulnerabilities/id/eb613de8-d298-471f-b585-2da3b5500f10?source=api-prod
- 2018-07-02 MEDIUM: Cross-Site Scripting (6.1.2 to 6.6.4). CVE-2018-0642, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f294af-7702-4762-806b-2abdb1454a7c?source=api-prod
- 2015-08-24 MEDIUM: Stored Cross-Site Scripting (up to 6.0.3.3). WF-b3325317-4ce7-468d-aee7-9b40fdf61d3c, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3325317-4ce7-468d-aee7-9b40fdf61d3c?source=api-prod
- 2011-07-22 MEDIUM: Cross-Site Scripting (up to 1.2.11). CVE-2011-4568, https://www.wordfence.com/threat-intel/vulnerabilities/id/118b9d85-1246-47f7-bdef-af47075576f2?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=fv-wordpress-flowplayer · HTML: https://todaywp.com/plugins/fv-wordpress-flowplayer