CVE-2021-39350: Foliovision Fv Flowplayer Video Player

Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days.

The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.

Affected products

• Foliovision Fv Flowplayer Video Player: from 7.5.0.727, up to and including 7.5.2.727

Published 2021-10-06. Last modified 2026-06-17.