{"affected":[{"defaultStatus":"unaffected","product":"FV Flowplayer Video Player","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"7.5.56.7212","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-85351","cwes":["CWE-918"],"description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/"}],"kev":null,"metrics":[],"modifiedAt":1793858424326,"publishedAt":1793858424326,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/"}],"remediation":[],"revision":"998a5fc4f1c632f5b9492acfc3d8ddbcc0fd90603e299b8f2c56a7a00d5b805c","sources":[{"modifiedAt":1793858424326,"name":"CNA: WPScan","retrievedAt":1793859009438,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85351"}],"ssvc":null,"status":"published","title":"FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import","updatedAt":1793859009438}