What the vulnerability does
01Description
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled the non-default 'Parse Vimeo and YouTube links' (parse_comments) plugin setting, and requires a submitted comment to be approved by an administrator before the payload is publicly delivered.
Explanation of Vulnerability in Simple Terms
02Summary
FV Flowplayer Video Player versions up to 7.5.49.7212 contain a cross-site scripting vulnerability that allows attackers to inject malicious scripts into web pages. The vulnerability can be exploited remotely without authentication or user interaction. An attacker can inject code that affects multiple users or components on the site.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in visitors' browsers and affects the site or other users.
Potential impact on your site
04Site Impact
Visitors' browsers can execute attacker-controlled scripts, potentially stealing data or redirecting users.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
June 9, 2026
CVE published
June 9, 2026
Record updated
