# cve.now: Foliovision

The newest entries naming Foliovision as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121764](https://cve.now/CVE-2026-121764.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-121515](https://cve.now/CVE-2026-121515.md): FV Flowplayer Video Player \<= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 5.4)
- [CVE-2026-109984](https://cve.now/CVE-2026-109984.md): FV Flowplayer Video Player \<= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments (CVSS 5.4)
- [CVE-2026-110533](https://cve.now/CVE-2026-110533.md): FV Flowplayer Video Player \<= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-110001](https://cve.now/CVE-2026-110001.md): FV Flowplayer Video Player \<= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute (CVSS 5.4)
- [CVE-2026-118079](https://cve.now/CVE-2026-118079.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.56.7212 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-86461](https://cve.now/CVE-2026-86461.md): FV Flowplayer Video Player \<= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video\_url' Parameter (CVSS 8.8)
- [CVE-2026-97398](https://cve.now/CVE-2026-97398.md): FV Flowplayer Video Player \<= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (CVSS 7.2)
- [CVE-2026-95807](https://cve.now/CVE-2026-95807.md): FV Player 8 \<= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-54868](https://cve.now/CVE-2026-54868.md): WordPress FV Simpler SEO plugin \<= 1.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-42699](https://cve.now/CVE-2026-42699.md): WordPress FV Player 8 plugin \<= 8.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-83526](https://cve.now/CVE-2026-83526.md): FV Player 8 \<= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos\[\].fv\_wp\_flowplayer\_field\_src Parameter (CVSS 8.8)
- [CVE-2026-97630](https://cve.now/CVE-2026-97630.md): FV Flowplayer Video Player \<= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute (CVSS 6.4)
- [CVE-2026-42695](https://cve.now/CVE-2026-42695.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-12135](https://cve.now/CVE-2026-12135.md): FV Flowplayer Video Player \<= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video\_player' Shortcode (CVSS 6.4)
- [CVE-2026-49773](https://cve.now/CVE-2026-49773.md): WordPress FV Flowplayer Video Player plugin \< 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-7556](https://cve.now/CVE-2026-7556.md): FV Flowplayer Video Player \<= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text (CVSS 7.2)
- [CVE-2025-68579](https://cve.now/CVE-2025-68579.md): WordPress FV Simpler SEO plugin \<= 1.9.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-66102](https://cve.now/CVE-2025-66102.md): WordPress FV Antispam plugin \<= 2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-32610](https://cve.now/CVE-2025-32610.md): WordPress Foliopress WYSIWYG plugin \<= 2.6.18 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2025-22628](https://cve.now/CVE-2025-22628.md): WordPress Filled In Plugin \<= 1.9.2 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2025-24613](https://cve.now/CVE-2025-24613.md): WordPress FV Thoughtful Comments plugin \<= 0.3.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-56032](https://cve.now/CVE-2024-56032.md): WordPress FV Descriptions plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- [CVE-2024-6338](https://cve.now/CVE-2024-6338.md): FV Player \<= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter (CVSS 8.8)
- [CVE-2024-35631](https://cve.now/CVE-2024-35631.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-32078](https://cve.now/CVE-2024-32078.md): WordPress FV Player plugin \<= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability (CVSS 4.1)
- [CVE-2024-32955](https://cve.now/CVE-2024-32955.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- [CVE-2023-4520](https://cve.now/CVE-2023-4520.md): FV Flowplayer Video Player \<= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update (CVSS 5.4)
- [CVE-2023-30499](https://cve.now/CVE-2023-30499.md): WordPress FV Flowplayer Video Player Plugin \<= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-25066](https://cve.now/CVE-2023-25066.md): WordPress FV Flowplayer Video Player Plugin \<= 7.5.30.7212 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-25613](https://cve.now/CVE-2022-25613.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.18.727 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (CVSS 4.1)
- [CVE-2022-25607](https://cve.now/CVE-2022-25607.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.15.727 - SQL Injection (SQLi) vulnerability (CVSS 6.6)
- [CVE-2018-0642](https://cve.now/CVE-2018-0642.md): Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HT (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/foliovision
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.