---
id: CVE-2026-110533
title: >-
  FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored
  Cross-Site Scripting via Shortcode Attributes
summary: >-
  The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored
  Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]'
  parameter in all versions up to, and including, 7.5.55.7212 due to
  insufficient input sa…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: foliovision
product: FV Flowplayer Video Player
affected:
  - fv_flowplayer_video_player <= 7.5.55.7212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T17:24:58.572446Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:25:10.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110533'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/a24acd18-c94d-4fde-bf6c-7f6b839336d1?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/flowplayer/modules/ad-popup.module.js#L64
  - url: >-
      https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php#L367
  - url: >-
      https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php#L370
  - url: >-
      https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/flowplayer-frontend.php#L993
  - url: >-
      https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/email-subscription.php#L729
  - url: >-
      https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/custom-videos.php#L364
  - url: >-
      https://github.com/foliovision/fv-wordpress-flowplayer/commit/7ea0b1bcbedcfc26b43a4b41a32e51c9f81b4332
tags:
  - cve.org
epss: 0.0032
epssPercentile: 0.25074
ingestedAt: '2026-11-05T16:24:31.276Z'
---

## Overview

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have enabled the "Allow visitors to upload videos to their profile" (profile_videos_enable_bio) setting before Subscriber-level users can submit profile videos.

## Affected

- `fv_flowplayer_video_player <= 7.5.55.7212`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.