CVE-2026-118079

Name of the Vulnerable Software and Affected Versions FolioVision FV Flowplayer Video Player versions prior to 7.5.56.7213

Description The FV Flowplayer Video Player plugin for WordPress is subject to PHP Object Injection due to the deserialization of untrusted input. This allows authenticated attackers with shop manager-level access or higher to inject a PHP Object. While no internal POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update FolioVision FV Flowplayer Video Player to a version newer than 7.5.56.7212.