CVE-2026-108068

LowCVSS 3.8/10Last modified Nov 4, 2026

Description

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	FV Flowplayer Video Player	>= 7.4.44.727, < 7.5.56.7212

References

https://wpscan.com/vulnerability/22aec931-839e-4b2e-bb40-6d00e58706ee/

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1080695.3The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before a CVE-2026-108076.3A vulnerability was determined in mjperpinosa stumasy. The impacted element is an unknown function of the file application/PHP/objects/profi CVE-2026-1080708.7A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to a CVE-2026-1080718.7Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authentica CVE-2026-1080725.4Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared th CVE-2026-1080735.3The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single u CVE-2026-108086.3A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /manage_student.php.CVE-2026-1080828.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, CVE-2026-1080867.5** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache CVE-2026-1080878.8** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache CVE-2026-1080887.5** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a mult CVE-2026-1080897.5** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. A