Braintx

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv player videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator-controlled "Allow visitors to upload videos to their profile" setting to be enabled, without which the vulnerable save routine is inaccessible to Subscriber-level users.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to move all published popups to the trash using a single GET request. The issue is exacerbated by a flaw in the `find()` function within the `SGPopup` class, which returns false for normally published popups when the `sg popup preview id` parameter is used, triggering the trash action for every popup on the site simultaneously.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `fv player videos[ fv player user video][]` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. This issue is exploitable if an administrator has enabled the "Allow visitors to upload videos to their profile" (`profile videos enable bio`) setting.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the `<custom user attribute slug>` (e.g., `hp custom link`) parameter. The issue is exploitable when an administrator configures a custom user attribute with a `display format` template that places the `%value%` token within an `href`, `src`, or `style` attribute context. When a user accesses the affected page, the injected scripts execute in their browser.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the `updateRows` action through the `data` variable of a table cell. The issue is exploitable by subscriber-level users if an administrator has added their role to the `access roles` setting, which provides the `dtgs nonce` required to access the vulnerable handler.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `REQUEST URI` parameter key, enabling the injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link. This issue is only exploitable if the `enable help` option is active, as the vulnerable HelpScout Beacon script block is only emitted under this configuration.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the `seopress google analytics matomo id` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. This issue is exploitable only if an administrator has delegated the Analytics management capability to the Subscriber role through the plugin's Advanced > Security settings.

Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a link, utilizing the `bulk action` parameter.