CVE-2020-35748: XSS
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fvwpfvvideoplayersrc JSON field in the data parameter.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-35748?
CVE-2020-35748 is a cross-site scripting (XSS) vulnerability in the FV Flowplayer Video Player plugin before version 7.4.37.727 for WordPress.
How does CVE-2020-35748 affect the FV Flowplayer Video Player plugin?
CVE-2020-35748 allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter of models/list-table.php in the FV Flowplayer Video Player plugin.
What is the severity of CVE-2020-35748?
CVE-2020-35748 has a severity rating of medium with a CVSS score of 5.4.
How can I fix CVE-2020-35748?
To fix CVE-2020-35748, you should update the FV Flowplayer Video Player plugin to version 7.4.37.727 or later.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-35748?
CVE-2020-35748 is associated with CWE-79, which is the Weakness ID for Improper Neutralization of Input During Web Page Generation (XSS).