{"cve":"CVE-2026-85351","enrichment":{"created":"2026-11-05T07:30:14.788890+00:00","updated":"2026-11-05T07:30:14.788895+00:00","vendors":[]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:24.326000+00:00","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/85xxx/CVE-2026-85351.json","references":["https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/"],"title":"FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import","updated":"2026-11-05T06:00:24.326000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:08.833000+00:00","description":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-85351.json","references":["https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/"],"title":null,"updated":"2026-11-05T06:17:08.833000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.","old":null},"type":"description"},{"details":{"new":"FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/"],"removed":[]},"type":"references"}],"id":"e9d405a2-be23-4ec4-a7ad-a017b888f0c5"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:24.326000+00:00","provider":"mitre"},"description":{"data":"The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/8e88b99b-66db-4ee5-a45a-33fed58ebc4f/"],"providers":["mitre","nvd"]},"title":{"data":"FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import","provider":"mitre"},"updated":{"data":"2026-11-05T06:00:24.326000+00:00","provider":"mitre"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":[],"providers":[]}}}