---
id: CVE-2026-85347
title: FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption
summary: >-
  The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not
  sanitize and escape a user-supplied value before outputting it in a page,
  which could allow users with the Contributor role and above to inject
  arbitrary web scr…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: FV Flowplayer Video Player
affected:
  - fv_flowplayer_video_player < 7.5.56.7212
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:52:22.905629Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:05:34.904Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85347'
references:
  - url: 'https://wpscan.com/vulnerability/96c74e92-ed40-4efe-8a25-5e662b072eda/'
tags:
  - cve.org
epss: 0.00153
epssPercentile: 0.04453
ingestedAt: '2026-11-05T21:36:00.777Z'
---

## Overview

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.

## Affected

- `fv_flowplayer_video_player < 7.5.56.7212`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.