What is GHSA-4xwf-gr64-f25h?

GHSA-4xwf-gr64-f25h is a security advisory published by GitHub Security Advisories with Medium severity. The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization...

Which CVE IDs does GHSA-4xwf-gr64-f25h cover?

GHSA-4xwf-gr64-f25h covers the following CVE IDs: CVE-2026-85346. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4xwf-gr64-f25h?

GHSA-4xwf-gr64-f25h has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-4xwf-gr64-f25hMediumCVSS 4.3

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization...

Vendor

GitHub Security Advisories

Published

November 5, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-85346 →

📋 Description

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85346
https://wpscan.com/vulnerability/b0167fea-fdce-4016-bb0f-329e0237f6d7
https://github.com/advisories/GHSA-4xwf-gr64-f25h