{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","packageName":"fv-wordpress-flowplayer","product":"FV Flowplayer Video Player","source":"CNA: Patchstack","vendor":"FolioVision","versions":[{"changes":[{"at":"7.5.57.7212","status":"unaffected"}],"lessThanOrEqual":"7.5.56.7212","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-118079","cwes":["CWE-502"],"description":"Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.","epss":{"date":"2026-11-03","percentile":0.22763,"score":0.003},"exploits":[],"kev":null,"metrics":[{"score":7.2,"severity":"high","source":"CNA: Patchstack","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.2,"severity":"high","source":"NVD: audit@patchstack.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793726278610,"publishedAt":1793287477276,"references":[{"source":"CNA: Patchstack","tags":["vdb-entry"],"url":"https://patchstack.com/database/wordpress/plugin/fv-wordpress-flowplayer/vulnerability/wordpress-fv-flowplayer-video-player-plugin-8-3-4-php-object-injection-vulnerability?_s_id=cve"},{"source":"audit@patchstack.com","tags":[],"url":"https://patchstack.com/database/wordpress/plugin/fv-wordpress-flowplayer/vulnerability/wordpress-fv-flowplayer-video-player-plugin-8-3-4-php-object-injection-vulnerability?_s_id=cve"}],"remediation":[{"kind":"fix","source":"CNA: Patchstack","text":"Update the WordPress FV Flowplayer Video Player plugin to the latest available version (at least 7.5.57.7212)."}],"revision":"de1a2b810058211494aec2363c1fdc7d357ff5ef3940bbe32709e8da2aa4bdbc","sources":[{"modifiedAt":1793724488846,"name":"CNA: Patchstack","retrievedAt":1793725814027,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118079"},{"modifiedAt":1793726278610,"name":"NVD","retrievedAt":1793729915870,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118079"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793725831747,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118079"}],"ssvc":{"assessedAt":1793385319750,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability","updatedAt":1793729915870}