CVE-2026-85345
FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.
| Vendor | unknown |
| Product | fv flowplayer video player |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown fv flowplayer video player
Be the first to know when new unknown vulnerabilities affecting unknown fv flowplayer video player are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / FV Flowplayer Video Player
7.5.44.7212 < 7.5.55.7212
References
Credits
Karthik Ramakrishnan WPScan