Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #6

WordPress plugin FV Flowplayer hit by server-side request flaw

Original: 🚨 EUVD-2026-117337 📊 Score: n/a 📦 Product: FV Flowplayer Video Player 🏢 Vendor: Unknown 📅 Updated: 2026-11-05 📝 The FV F

A new vulnerability entry, EUVD-2026-117337, was published on 5 November 2026 concerning the FV Flowplayer Video Player plugin for WordPress. Versions before 7.5.56.7212 fail to validate a user-supplied URL before performing a server-side fetch, exposing sites to server-side request forgery. No severity score has been assigned yet, and the vendor is listed as unknown.

Why now: Fresh vulnerability disclosure prompting WordPress administrators to check whether their sites run an affected plugin version.

FV Flowplayer Video PlayerWordPressEUVD-2026-117337

Open on mastodon →

Evidence

• 🚨 EUVD-2026-117337 📊 Score: n/a 📦 Product: FV Flowplayer Video Player 🏢 Vendor: Unknown 📅 Updated: 2026-11-05 📝 The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/4966560