{"id":"CVE-2026-110533","title":"FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes","summary":"The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sa…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"foliovision","product":"FV Flowplayer Video Player","affected":["fv_flowplayer_video_player <= 7.5.55.7212"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T17:24:58.572446Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:25:10.191Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110533","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a24acd18-c94d-4fde-bf6c-7f6b839336d1?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js#L64"},{"url":"https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php#L367"},{"url":"https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php#L370"},{"url":"https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/flowplayer-frontend.php#L993"},{"url":"https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/email-subscription.php#L729"},{"url":"https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php#L364"},{"url":"https://github.com/foliovision/fv-wordpress-flowplayer/commit/7ea0b1bcbedcfc26b43a4b41a32e51c9f81b4332"}],"tags":["cve.org"],"epss":0.0032,"epssPercentile":0.25074,"ingestedAt":"2026-11-05T16:24:31.276Z","slug":"CVE-2026-110533","body":"## Overview\n\nThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the \"Allow visitors to upload videos to their profile\" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.\n\n## Affected\n\n- `fv_flowplayer_video_player <= 7.5.55.7212`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}