CVE-2026-85344

MediumCVSS 4.3/10Last modified Nov 10, 2026

Description

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they should not be able to edit.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-853454.1The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server CVE-2026-853464.3The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud sto CVE-2026-853476.8The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it i CVE-2026-853484.3The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attacker CVE-2026-853494.3The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to,CVE-2026-85355.3Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the CVE-2026-853505.3The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign be CVE-2026-853515.0The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fet CVE-2026-853527.0Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-853537.5Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.CVE-2026-853547.0Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2026-853557.0Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate p