FV Flowplayer Video Player

79 Quality Score

Active Installs

18/30

At 20,000 active installs with a popularity score of 64/30, it sits in the mid-tier for video plugins, well behind Presto Player's 100,000 installs but tied with All-in-One Video Gallery.

Update Freshness

25/25

A maintenance score of 100/25 reflects the most recent update on 2026-07-07 and confirmed compatibility with WordPress 6.9.4, which is exceptional for an older plugin.

User Rating

13/15

An 88/100 rating from 90 reviewers suggests a small but loyal user base that has been largely satisfied with the plugin's stability.

Support Health

8/15

A support health score of 50/15 with zero threads and zero resolutions is a real red flag: there is no recent public track record of help being offered or needed, and you have no way to gauge response times.

WP Compatibility

15/15

A perfect 100/15 compatibility score comes from running cleanly on WordPress 3.5 or newer, including the current 6.9.4 release, with no PHP minimum specified.

Scores higher than 69% of indexed plugins

About

WordPress's most reliable, easy to use and feature-rich video player. Supports responsive design, HTML5, playlists, ads, stats, Vimeo and YouTube.

Active Installs 10k+

Rating ★★★★ 4.4/5

Last Updated 2026-08-18 11:18am GMT

Requires WordPress 3.5+

Tested Up To 6.9.7

Security History

27 known vulnerabilities, all patched

3 Critical 3 High 21 Medium

Most recent: June 30, 2026

View details ▸

FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode Medium

June 30, 2026 Patched in ["7.5.52.7212"] CVE-2026-12135

FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text High

June 8, 2026 Patched in ["7.5.50.7212"] CVE-2026-7556

FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting Medium

June 4, 2026 Patched in ["7.5.51.7212"] CVE-2026-49773

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Medium

December 3, 2024 Patched in ["7.5.48.7212"] CVE-2024-5020

FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter High

July 18, 2024 Patched in ["7.5.47.7212"] CVE-2024-6338

FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting Medium

May 27, 2024 Patched in ["7.5.46.7212"] CVE-2024-35631

FV Flowplayer Video Player <= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery Medium

April 22, 2024 Patched in ["7.5.45.7212"] CVE-2024-32955

FV Flowplayer Video Player <= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect Medium

April 11, 2024 Patched in ["7.5.45.7212"] CVE-2024-32078

FV Flowplayer Video Player <= 7.5.41.7212 - Reflected Cross-Site Scripting Medium

March 26, 2024 Patched in ["7.5.44.7212"] CVE-2024-22299

FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

March 16, 2024 Patched in ["7.5.44.7212"] CVE-2024-29122

FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update Medium

August 24, 2023 Patched in ["7.5.39.7212"] CVE-2023-4520

FV Flowplayer Video Player <= 7.5.32.7212 - Reflected Cross-Site Scripting via id Medium

May 3, 2023 Patched in ["7.5.35.7212"] CVE-2023-30499

FV Flowplayer Video Player <= 7.5.30.7210 - Cross-Site Request Forgery Medium

February 2, 2023 Patched in ["7.5.31.7212"] CVE-2023-25066

FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting Medium

April 4, 2022 Patched in ["7.5.19.728"] CVE-2022-25613

FV Flowplayer Video Player <= 7.5.15.727 - SQL Injection High

March 18, 2022 Patched in ["7.5.18.727"] CVE-2022-25607

FV Flowplayer Video Player 7.5.0.727 - 7.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter Medium

October 5, 2021 Patched in ["7.5.3.727"] CVE-2021-39350

FV Flowplayer Video Player <= 7.4.37.727 - Authenticated Stored Cross-Site Scripting Medium

January 15, 2021 Patched in ["7.4.38.727"] CVE-2020-35748

FV Flowplayer Video Player <= 7.3.18.727 - SQL Injection Critical

July 11, 2019 Patched in ["7.3.19.727"] CVE-2019-13573

FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Information Exposure Medium

May 20, 2019 Patched in ["7.3.15.727"] CVE-2019-14800

FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection Critical

May 20, 2019 Patched in ["7.3.15.727"] CVE-2019-14801

FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting Medium

May 20, 2019 Patched in ["7.3.14.727"] CVE-2019-14799

FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Data Exposure Medium

May 16, 2019 Patched in ["7.3.15.727"]

FV Flowplayer Video Player <= 7.3.14.727 - Unauthenticated SQL Injection Critical

May 16, 2019 Patched in ["7.3.15.727"]

FV Flowplayer Video Player <= 7.2.0.727 - Reflected Cross-Site Scripting Medium

September 21, 2018 Patched in ["7.2.1.727"]

FV Flowplayer Video Player 6.1.2 - 6.6.4 - Cross-Site Scripting Medium

July 2, 2018 Patched in ["6.6.5"] CVE-2018-0642

FV Flowplayer Video Player <= 6.0.3.3 - Stored Cross-Site Scripting Medium

August 24, 2015 Patched in ["6.0.3.4"]

FV Flowplayer Video Player <= 1.2.11 - Cross-Site Scripting Medium

July 22, 2011 Patched in ["1.2.12"] CVE-2011-4568

What It Does

FV Flowplayer Video Player embeds a custom HTML5 video player into WordPress sites, supporting self-hosted MP4/WebM files, Vimeo, YouTube, and playlist-style galleries. It also handles responsive sizing, basic ad insertion, and viewable analytics for video plays. Practically, you get a self-hosted video player layer on top of WordPress without needing a separate streaming service.

Who It's For

This plugin suits site owners who self-host their video files or want more control than the default WordPress embed block offers, particularly small publishers, course creators, and media sites running 5,000 to 50,000 monthly visits. It is also a fit for teams that need built-in analytics and ad support without bolting on a separate video SaaS.

Who Should Skip It

If you already use Vimeo, YouTube, or Wistia for hosting and only need to embed those links, the default WordPress embed block or a lighter plugin like iframe is enough. Large media operations needing adaptive bitrate streaming, DRM, or enterprise CDN features should look at Presto Player or a dedicated video platform instead.

The Bottom Line

FV Flowplayer Video Player scores 79.96/100, a solid mid-tier result held up by flawless maintenance and broad compatibility but dragged down by thin public support evidence and modest install counts. It is a reasonable pick for self-hosted video on small to mid-sized WordPress sites, though power users should weigh Presto Player first. Verify its analytics and ad features still meet your needs before committing on a revenue-critical site.

Related Plugins

Presto Player 84/100

Pick Presto Player instead if you run a larger site, need adaptive HLS streaming, or want deeper LMS integrations like LearnDash and TutorLMS.

iframe 82/100

Pick iframe if your only goal is to embed existing YouTube, Vimeo, or Wistia URLs and you want the absolute lightest possible plugin.

All-in-One Video Gallery 81/100

Pick All-in-One Video Gallery if you want a gallery-first video experience with categories, search, and frontend submission built in.

HTML5 Video Player – Embed and Play Videos in Custom Player 81/100

Pick HTML5 Video Player if you mostly play self-hosted MP4 files and want a simpler, more focused player without FV Flowplayer’s ads or analytics layers.

Videopack 80/100

Pick Videopack if automatic thumbnail generation from video files is a priority, since FV Flowplayer requires you to set posters manually.